Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4debcb65074d62b7f8417e0bad63e37.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
d4debcb65074d62b7f8417e0bad63e37.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
d4debcb65074d62b7f8417e0bad63e37.dll
-
Size
80KB
-
MD5
d4debcb65074d62b7f8417e0bad63e37
-
SHA1
5ca1084412487d08ddf4579f41ef3de2185d1da1
-
SHA256
590dce132dad986fb236f88958a7c2b4d621428992519f4760846aed7dd05dff
-
SHA512
ab8b1425d0d469cea827d4fc73f320b7b344e3b0ef3d04b29354654e2f5daf46c25bd6cc1b3ba826b44c956fe94719d881073a63a6494779209c0d0e62b960f5
-
SSDEEP
384:HWtHvCXI+egJlq7/h9swEi80LbqQvszkpNRwYyGCiA3L0f4D:HoHvCXI+eGlq7/XgiRbq9YNRwlGk70f6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2836 wrote to memory of 2464 2836 rundll32.exe 88 PID 2836 wrote to memory of 2464 2836 rundll32.exe 88 PID 2836 wrote to memory of 2464 2836 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4debcb65074d62b7f8417e0bad63e37.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4debcb65074d62b7f8417e0bad63e37.dll,#12⤵PID:2464
-