Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 03:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7934919719f200be0756a8f4cb0db1dc.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
7934919719f200be0756a8f4cb0db1dc.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
7934919719f200be0756a8f4cb0db1dc.dll
-
Size
116KB
-
MD5
7934919719f200be0756a8f4cb0db1dc
-
SHA1
8de4d60845ee68eb5cf9cedc1d04fa07151a1bf7
-
SHA256
448e7c0561712646d663caedc2eecc9dc7375ef2eca4b8ecee1b2cd69938c222
-
SHA512
896a22f3317923cfa573944cc77b87ef553b955552315706e2ba91642b59d252ef176b802e8f17f8f10d030332e652efd1c2feb9c7b7ca6618549ed8197e0cb0
-
SSDEEP
1536:DSITOQsLoJymNPpGHX0/s2HoAeMvm/hv2/BMMM9bPvr8ewFRtz0GnxtIze9kx38C:DMQpTPEHys2ZeMO/eKl9bPviyGnxGTp
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4896 wrote to memory of 4504 4896 rundll32.exe 87 PID 4896 wrote to memory of 4504 4896 rundll32.exe 87 PID 4896 wrote to memory of 4504 4896 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7934919719f200be0756a8f4cb0db1dc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7934919719f200be0756a8f4cb0db1dc.dll,#12⤵PID:4504
-