Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 23:47
Behavioral task
behavioral1
Sample
b9f86db30bfbcb12328b79984f2c5826.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9f86db30bfbcb12328b79984f2c5826.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
b9f86db30bfbcb12328b79984f2c5826.dll
-
Size
200KB
-
MD5
b9f86db30bfbcb12328b79984f2c5826
-
SHA1
7841060fa6dc5982fe583aafbc628333beb79533
-
SHA256
04c8b20143d0a5d92e21123c52417fdc06abaa5ed9baf7a40bc6bbdf79c0c236
-
SHA512
d2af375b9239f3a2884274c90ec2740232556cdd1f04424234a43bfbabf808f7df619e05531437572a23399cff2e83cf8d87e0bf49be88be487aa5cb44c9ac28
-
SSDEEP
6144:2o7uaJ1H/7e+X7CmNL0Tb/bHd/thJXSN:1uajH/7r7wfRPJXI
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3840-0-0x0000000000400000-0x000000000048A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2516 wrote to memory of 3840 2516 rundll32.exe 88 PID 2516 wrote to memory of 3840 2516 rundll32.exe 88 PID 2516 wrote to memory of 3840 2516 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9f86db30bfbcb12328b79984f2c5826.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9f86db30bfbcb12328b79984f2c5826.dll,#12⤵PID:3840
-