Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/01/2024, 04:34
General
-
Target
76654e6cb55d459aef4bade9e86c9820.dll
-
Size
23KB
-
MD5
76654e6cb55d459aef4bade9e86c9820
-
SHA1
fe6bfadab101d02890b3f6960526f82ce49b2ee1
-
SHA256
39f4f6a61b2ed4956ba96d61acae784fbf67f1a48b83f1218a1959168323d078
-
SHA512
a3c4a97268132ab1c198020ccccf8fa7a303f937f78369888cb347676e65497e3cbe4710601c5f633cb481cb188d952240d80003b6e1901c5039445ec7e389a3
-
SSDEEP
384:DaGcv+dJrxlI2z8j0INbuLsPMwPq/hc9ZYAbw1cZZqpruc:O1+dhxlI08j0INbuLsPUnAbWcZg5V
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\76654e6cb55d459aef4bade9e86c9820.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\76654e6cb55d459aef4bade9e86c9820.dll,#13⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-