Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4947572113837e137504a67ae27068e6.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
4947572113837e137504a67ae27068e6.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
4947572113837e137504a67ae27068e6.dll
-
Size
7KB
-
MD5
4947572113837e137504a67ae27068e6
-
SHA1
b3f9d4c66c6521eadd62b5e8a23ee9ee68fee197
-
SHA256
874d8ab5a095ffcb98786ae85160edc3dfb9eadadb98858e54d55578eea8473f
-
SHA512
0df75c06169c2d02b68f8937a23916db35d3e60c59849872a66c440d4dffa1f3ccad5754824a6c06803bcb4e5b2a728d26649835a1e1a1892f97a6ef304dd833
-
SSDEEP
96:wb4VHccYJUC/aFbz/j0OvaPcd3cX5aXW:wUaJf/aFbP0OH2JaX
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4784 wrote to memory of 4404 4784 rundll32.exe 85 PID 4784 wrote to memory of 4404 4784 rundll32.exe 85 PID 4784 wrote to memory of 4404 4784 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4947572113837e137504a67ae27068e6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4947572113837e137504a67ae27068e6.dll,#12⤵PID:4404
-