Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 23:10
Behavioral task
behavioral1
Sample
16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28.dll
Resource
win10v2004-20240226-en
General
-
Target
16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28.dll
-
Size
899KB
-
MD5
b0b288d5e3575706eca701a1b3519334
-
SHA1
cf67878866ac32ca723ff12ed56ece74b5f31a3d
-
SHA256
16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28
-
SHA512
a50d339552a036c4ce3ffacd78b7167e5f61d70de02df0d9a577ee752fe187b7071258569cbda1550631f9697d2c96bc89ca73f96141d9f871d0d119f307403b
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX/:7wqd87V/
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4856 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 536 wrote to memory of 4856 536 rundll32.exe 91 PID 536 wrote to memory of 4856 536 rundll32.exe 91 PID 536 wrote to memory of 4856 536 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵PID:3416