Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8.dll
Resource
win10v2004-20240412-en
General
-
Target
5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8.dll
-
Size
14KB
-
MD5
896569aad24bb40db2db31a0dd646ee1
-
SHA1
00487b71a5b8f65b800d11e5038299f9f3f0c6a6
-
SHA256
5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8
-
SHA512
dfecc033a8922f49ddf53c47de8b876f1722b23d326492ac91c63fa80f486102d0b60a6f88dc610339aa92002023c7d6decb6920503ab68b17be2ada167e9e2a
-
SSDEEP
192:WLdDiW8J12YEVOEOYGGuFhZVinlYJL/eV/9NIDLTmKSZuSR:WLNifCYEMEfuh5qF/+LT9S5R
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4916 wrote to memory of 1852 4916 rundll32.exe 84 PID 4916 wrote to memory of 1852 4916 rundll32.exe 84 PID 4916 wrote to memory of 1852 4916 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8.dll,#12⤵PID:1852
-