Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412.dll
Resource
win10v2004-20240226-en
General
-
Target
4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412.dll
-
Size
13KB
-
MD5
94a186b1e49bac642029fcba57b838bb
-
SHA1
2316c485944194e056dc4ee4f7fcc121f9a705c3
-
SHA256
4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412
-
SHA512
2b305fde3e5487409dd17d5f9e38b0a7579c56db7a4f5854a0c4b83f4c6f03c3f0062bca055f28ee23b0d76ffe759a187ce94a1b38d2d3f513a9267a852e25f8
-
SSDEEP
192:NnI+cigL7G9LQRd6fQoEYuAXGQuRtg9yUusK:JI+RgL7G9L1fQozluRtvUk
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1016 wrote to memory of 992 1016 rundll32.exe 88 PID 1016 wrote to memory of 992 1016 rundll32.exe 88 PID 1016 wrote to memory of 992 1016 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412.dll,#12⤵PID:992
-