Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
b59cbd494a290e3c98db577558c97071d2667ad414e77495e56132c4c5b81313.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b59cbd494a290e3c98db577558c97071d2667ad414e77495e56132c4c5b81313.dll
Resource
win10v2004-20240319-en
General
-
Target
b59cbd494a290e3c98db577558c97071d2667ad414e77495e56132c4c5b81313.dll
-
Size
1.2MB
-
MD5
90d243c55b44d692897e5e9a2e786f65
-
SHA1
e3ca89e1c158fca20de36914aff848f655063d40
-
SHA256
b59cbd494a290e3c98db577558c97071d2667ad414e77495e56132c4c5b81313
-
SHA512
7fdf1399445dc688eabb122e66446aa4c20cedd82e79cd26d57c37fc7c19a2fc34038ba6c32452284761324c72bfa6d198bedc5ca1a187d3a0d61f3fed999033
-
SSDEEP
24576:BDqyY98fMerZKXCrhslbcs1sxNjjYEij+jsLJ/3/3FeOhoA6n4SDuuDChB:dxY98kerZD24siLd4J/3/s4ZSvDC
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2036 1768 rundll32.exe 93 PID 1768 wrote to memory of 2036 1768 rundll32.exe 93 PID 1768 wrote to memory of 2036 1768 rundll32.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b59cbd494a290e3c98db577558c97071d2667ad414e77495e56132c4c5b81313.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b59cbd494a290e3c98db577558c97071d2667ad414e77495e56132c4c5b81313.dll,#12⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=2264,i,7994609493164365963,13212734413040148104,262144 --variations-seed-version /prefetch:81⤵PID:2012