Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 17:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c6729519147dd5fa64fc621e0e0867a1.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
c6729519147dd5fa64fc621e0e0867a1.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
c6729519147dd5fa64fc621e0e0867a1.dll
-
Size
368KB
-
MD5
c6729519147dd5fa64fc621e0e0867a1
-
SHA1
723af5f224cd7435ed6580e53ce43a6cc479770d
-
SHA256
6168f2bd5b82e5bd36fd74db17d0a600675297cc8af8116270d757188f4da854
-
SHA512
e26578a1ec6a61cab460b8aa61576ece93dd71090ff332ecb94992c2afea210bcfa6e4d6572cb1dd784d151e2d240576eff3c60a5def3632f9adbc16a2213236
-
SSDEEP
6144:9Xi9jNdUIfhr6nLuwTcmhCfIJ9wHtMsr08/1iKe3FZ2yOHlFg0Dn6TJCAzgvLtlW:pi9jNdU8r6nLuMNwH2S1k6hmJ4LtlG4B
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2696 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4824 wrote to memory of 2696 4824 rundll32.exe 88 PID 4824 wrote to memory of 2696 4824 rundll32.exe 88 PID 4824 wrote to memory of 2696 4824 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6729519147dd5fa64fc621e0e0867a1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6729519147dd5fa64fc621e0e0867a1.dll,#12⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2696
-