Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 03:52
Static task
static1
Behavioral task
behavioral1
Sample
c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll
Resource
win10v2004-20240412-en
General
-
Target
c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll
-
Size
548KB
-
MD5
3182365a61692919f67a612dcfac1b24
-
SHA1
7e65586ee2c14b0ed864914d637a6682ff73b60b
-
SHA256
c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7
-
SHA512
bd701f61232ba158eed85610ce88bd960e775f35745e80d0f2a028e77927915f7410cc45fb20f70163ceff2181c8a8a9c0f292f0113c008ee17a13c9fd7cd98d
-
SSDEEP
6144:YltBsygUtAzpmWJqAiF+vAeDukzhQs1fjVcR/SnmFaB7aS7gtRHG4YSfvj7D5bN/:gttcPzhjZm3nNqmomAgiakjZQ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4684 wrote to memory of 2420 4684 rundll32.exe 86 PID 4684 wrote to memory of 2420 4684 rundll32.exe 86 PID 4684 wrote to memory of 2420 4684 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll,#12⤵PID:2420
-