Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 05:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98967c02969740487b5c59891189ffba.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
98967c02969740487b5c59891189ffba.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
98967c02969740487b5c59891189ffba.dll
-
Size
44KB
-
MD5
98967c02969740487b5c59891189ffba
-
SHA1
2f0014acd5531dacace84db2d356a170822e2753
-
SHA256
1f410b89cdbf3e5a0b000bd81708839d6a06a6c1e6af6cb560ede8854a6c4664
-
SHA512
8aae595b573d3c4b776fd3154cda7673952eed4a0768f4f3aef66098a1f16974ee020b096e4dc141af45df0be5124fe4e0d1e749d1a89394167b65b5acbd4e8b
-
SSDEEP
768:5aqcMRm3MRNtUdL8jfnMhbanF0lUSSYRt212fUrHq/wAZ7lwSwEPHoISlY:514fL8jf7nEUSXRt212MrHq/wAZ67EPo
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4960 wrote to memory of 4228 4960 rundll32.exe 15 PID 4960 wrote to memory of 4228 4960 rundll32.exe 15 PID 4960 wrote to memory of 4228 4960 rundll32.exe 15
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\98967c02969740487b5c59891189ffba.dll,#11⤵PID:4228
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\98967c02969740487b5c59891189ffba.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4960