Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 13:57
Behavioral task
behavioral1
Sample
7ae3d9ab01ba71fa88b1d60c6103e2af61095989c0b366a8f71df0ddbefba50c.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7ae3d9ab01ba71fa88b1d60c6103e2af61095989c0b366a8f71df0ddbefba50c.dll
Resource
win10v2004-20240226-en
General
-
Target
7ae3d9ab01ba71fa88b1d60c6103e2af61095989c0b366a8f71df0ddbefba50c.dll
-
Size
899KB
-
MD5
c2cb6dfed874f52c37a7c82b8810e5ea
-
SHA1
f314c111802a0b9a2344cc9a9f26021e8fd97da3
-
SHA256
7ae3d9ab01ba71fa88b1d60c6103e2af61095989c0b366a8f71df0ddbefba50c
-
SHA512
f22e9d0faeb578fbfa27cc260067e08e65fec694e7695024258c61fed06b5ded295703c8516f7b484d01bf9411bb1236a6d30e46e8bc2297267ced2770217c5b
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXF:7wqd87VF
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 228 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2764 wrote to memory of 228 2764 rundll32.exe 88 PID 2764 wrote to memory of 228 2764 rundll32.exe 88 PID 2764 wrote to memory of 228 2764 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ae3d9ab01ba71fa88b1d60c6103e2af61095989c0b366a8f71df0ddbefba50c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ae3d9ab01ba71fa88b1d60c6103e2af61095989c0b366a8f71df0ddbefba50c.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:228
-