Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2024, 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
598b3d1844f504953666de1e2da08609.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
598b3d1844f504953666de1e2da08609.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
598b3d1844f504953666de1e2da08609.dll
-
Size
12KB
-
MD5
598b3d1844f504953666de1e2da08609
-
SHA1
53f8c987794a7a8d6f3c90ab5ffb26ab092e9cdd
-
SHA256
555cb2fd710da79f46f088b9fc79b541d8fec54239a71dd4e1be0c02fadd9eec
-
SHA512
e619b4645097e98936e01a8e0d3f4ea36ace7efe46ef263c18441e4cb93bdbc6f93456f57386afb7da39731697715b8a59f73699ccbd30a1c86b2963bb3ecf1e
-
SSDEEP
384:f+4jYlbp4jjoj4gPADuJyeDAfKcg20xse/9ZN0:fAb66LpstfKZVse/9ZS
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 664 Process not Found -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5080 wrote to memory of 3600 5080 rundll32.exe 89 PID 5080 wrote to memory of 3600 5080 rundll32.exe 89 PID 5080 wrote to memory of 3600 5080 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\598b3d1844f504953666de1e2da08609.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\598b3d1844f504953666de1e2da08609.dll,#12⤵PID:3600
-