Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 20:15
Static task
static1
Behavioral task
behavioral1
Sample
6adc2fcc02b780533559a8faa4cc333a96c4f82ca909ba34e9e35161a07ec18b.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6adc2fcc02b780533559a8faa4cc333a96c4f82ca909ba34e9e35161a07ec18b.dll
Resource
win10v2004-20240226-en
General
-
Target
6adc2fcc02b780533559a8faa4cc333a96c4f82ca909ba34e9e35161a07ec18b.dll
-
Size
7KB
-
MD5
225c3c5531e01db88c3ecbeac3c49af5
-
SHA1
8e021e2932ea57d6f82abd3b9d66d8240c48fd9a
-
SHA256
6adc2fcc02b780533559a8faa4cc333a96c4f82ca909ba34e9e35161a07ec18b
-
SHA512
c9976c0e6dadc0807f55119cdd882622f9194f2c1fbe4ff63892d94a057717fbf71e6d8c594ed704ad47c0339d3276f14b9e8cf2c1c5cf809d1aefb9486741aa
-
SSDEEP
96:wb4VHccYJUC/aFbz/j0OvaPTd3cX5aXW:wUaJf/aFbP0O82JaX
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4608 wrote to memory of 1032 4608 rundll32.exe 96 PID 4608 wrote to memory of 1032 4608 rundll32.exe 96 PID 4608 wrote to memory of 1032 4608 rundll32.exe 96
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6adc2fcc02b780533559a8faa4cc333a96c4f82ca909ba34e9e35161a07ec18b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6adc2fcc02b780533559a8faa4cc333a96c4f82ca909ba34e9e35161a07ec18b.dll,#12⤵PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵PID:2576