Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 00:10
Behavioral task
behavioral1
Sample
9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46.dll
Resource
win10v2004-20240226-en
General
-
Target
9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46.dll
-
Size
51KB
-
MD5
789bf63cd8fbbb23e1ee07a29e41b467
-
SHA1
949e66bb865611b035857c493fba4ef993a6bcc5
-
SHA256
9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46
-
SHA512
bf2e9355f9a208dd0b9c027c231090183217d2be5bbc959ff3b5f9b43a30ff301c3c2c297c9b35a86eac5c4255df3099879860994f4ddd777ddf5904ca5acdaa
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLNJYH5:1dWubF3n9S91BF3fbohJYH5
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4928 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2376 wrote to memory of 4928 2376 rundll32.exe 85 PID 2376 wrote to memory of 4928 2376 rundll32.exe 85 PID 2376 wrote to memory of 4928 2376 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4928
-