Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 21:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02b8afba5c85bdf5e68b24cca2a240de.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
02b8afba5c85bdf5e68b24cca2a240de.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
02b8afba5c85bdf5e68b24cca2a240de.dll
-
Size
6KB
-
MD5
02b8afba5c85bdf5e68b24cca2a240de
-
SHA1
cba3d16e5b5cabfddaafcb6ed1d4338ee2469380
-
SHA256
b8b9ed5e6beb6c9bdf7608cf29832378a049d33d13cfa20a9b52275ceb74eff2
-
SHA512
79484a3bcead12bc65fa55addecd5f375452de6941a8b83d464e96c8a94145c9a0da35ab575d5a5ef3fe8f836a9253180c829115fce5eb886e1b94eb82227ae4
-
SSDEEP
48:6WQV5YVOqtV0H1pw9ygYVUG05B+BDq9J5SC:8qtV0HAr40B+FqX5SC
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1572 wrote to memory of 1744 1572 rundll32.exe 86 PID 1572 wrote to memory of 1744 1572 rundll32.exe 86 PID 1572 wrote to memory of 1744 1572 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\02b8afba5c85bdf5e68b24cca2a240de.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\02b8afba5c85bdf5e68b24cca2a240de.dll,#12⤵PID:1744
-