Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
b8e6a1851d077383007b66d96deca1451a79c1c5a55a6e99e8ab7dc20d958a54.dll
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
b8e6a1851d077383007b66d96deca1451a79c1c5a55a6e99e8ab7dc20d958a54.dll
Resource
win10v2004-20240226-en
General
-
Target
b8e6a1851d077383007b66d96deca1451a79c1c5a55a6e99e8ab7dc20d958a54.dll
-
Size
6KB
-
MD5
9730a5b3f8e23aac0dda58e75ff4fc8c
-
SHA1
50c6edd09ce1799c9f1975dd234c2906b627acee
-
SHA256
b8e6a1851d077383007b66d96deca1451a79c1c5a55a6e99e8ab7dc20d958a54
-
SHA512
e02261cc553186697c56624e22f5f4f66e85fef31dc0ecbfb4dac7d48a754cbafb0e47bb9f5d419c464906ba31c94d22fa6b00a1dd3d86486d1c4e89c5c0c1d0
-
SSDEEP
48:6AA35YVOQDV8FszwydlAYsLFV3G0oB+BDq9J5S2:0QDV8FscMjsLFV3AB+FqX5S2
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4368 wrote to memory of 2236 4368 rundll32.exe 85 PID 4368 wrote to memory of 2236 4368 rundll32.exe 85 PID 4368 wrote to memory of 2236 4368 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e6a1851d077383007b66d96deca1451a79c1c5a55a6e99e8ab7dc20d958a54.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e6a1851d077383007b66d96deca1451a79c1c5a55a6e99e8ab7dc20d958a54.dll,#12⤵PID:2236
-