Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 11:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d0ffc9addf7ee25cbef6bd78f0954e0.dll
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7d0ffc9addf7ee25cbef6bd78f0954e0.dll
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
7d0ffc9addf7ee25cbef6bd78f0954e0.dll
-
Size
410KB
-
MD5
7d0ffc9addf7ee25cbef6bd78f0954e0
-
SHA1
3d8890af473a6e2c277b3406e759eecfe62ce210
-
SHA256
cb6a37c8df8be9896dfc18fccade9c8f21308c243b32fc5d50d53d2b8facf596
-
SHA512
c0a65fdb9a3969dc708807e7034aaff75384a06bad63d1ba8d59ce871ab9fa4f68168bf6f15b5b13a142f613552863e8462c21e802267c3a0600aa6147dbafe3
-
SSDEEP
6144:QtzwhV1tTj7oiyfJGNr8m0GlgcxOug48Dg2GMipwUtpduAsKkcRFhIal23rjpHqI:QtzwT1NDvrRieIDQLw8u0ZOF3Nqzk
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3016 rundll32.exe 3016 rundll32.exe 3016 rundll32.exe 3016 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 rundll32.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3016 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4720 wrote to memory of 3016 4720 rundll32.exe 87 PID 4720 wrote to memory of 3016 4720 rundll32.exe 87 PID 4720 wrote to memory of 3016 4720 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d0ffc9addf7ee25cbef6bd78f0954e0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d0ffc9addf7ee25cbef6bd78f0954e0.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3016
-