Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 15:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61bb485ef3ee09e6ada8c0a820a4d639cec6b98bfd35b4632f1425962ea94520.dll
Resource
win7-20231129-en
1 signatures
150 seconds
General
-
Target
61bb485ef3ee09e6ada8c0a820a4d639cec6b98bfd35b4632f1425962ea94520.dll
-
Size
2.3MB
-
MD5
fcb48cbe86787b7b8fce6b222bdfd8d7
-
SHA1
94b1fd70aaa59ac53a9e3665f931254721912a44
-
SHA256
61bb485ef3ee09e6ada8c0a820a4d639cec6b98bfd35b4632f1425962ea94520
-
SHA512
4e61b559e370fb87374a2e41245253b3baf44fac7128a548046ef7bf6cc550f5f76a0b8989f8dbc2e1b04d5924abffb7f7d6a4845fc052eee37cff53cb538fde
-
SSDEEP
24576:zUeaq7sJWp6sXczDHK2WQd7Hand4Mb7M64AA:f76zDq2WQd7Hand4Mb7M64AA
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1412 wrote to memory of 1244 1412 rundll32.exe 84 PID 1412 wrote to memory of 1244 1412 rundll32.exe 84 PID 1412 wrote to memory of 1244 1412 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61bb485ef3ee09e6ada8c0a820a4d639cec6b98bfd35b4632f1425962ea94520.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61bb485ef3ee09e6ada8c0a820a4d639cec6b98bfd35b4632f1425962ea94520.dll,#12⤵PID:1244
-