Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/02/2024, 12:19
General
-
Target
97229fd051d6380704ac2abcbe438b8a.dll
-
Size
52KB
-
MD5
97229fd051d6380704ac2abcbe438b8a
-
SHA1
3ea244080cae190587348483f015371fc65bce0f
-
SHA256
57f3186ba5a3a986f9e135daff6d77514e7f88e991fb0a8624f7d7c5b59306e7
-
SHA512
55ef474fd2991772b796a79fe4b4521705f338f95343f77f8d286061850bdac1836285314a7f3c1d4d850bc99d80780c830efb65fd39c9317702a8f0034cc3d7
-
SSDEEP
768:Av000btDotnY8gVhCT1IqtyP29k56955RsMYavvFDw0nIX0WcOUYZY:m9yxDhCT1xtq29k56P5RHjDw0npWeY+
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97229fd051d6380704ac2abcbe438b8a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97229fd051d6380704ac2abcbe438b8a.dll,#12⤵
- Blocklisted process makes network request
- Drops file in Drivers directory
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-