Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 16:09
Static task
static1
Behavioral task
behavioral1
Sample
537c1bda8e48ca0a6d8f738a04dbd6b1a5b64b5dcd72dd44d909630ea2bc4015.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
537c1bda8e48ca0a6d8f738a04dbd6b1a5b64b5dcd72dd44d909630ea2bc4015.dll
Resource
win10v2004-20240412-en
General
-
Target
537c1bda8e48ca0a6d8f738a04dbd6b1a5b64b5dcd72dd44d909630ea2bc4015.dll
-
Size
81KB
-
MD5
ed80953bec0ce6ae19459daa8b347852
-
SHA1
63dabfa3fe6476d59cd240f98a23ccee2ff5957d
-
SHA256
537c1bda8e48ca0a6d8f738a04dbd6b1a5b64b5dcd72dd44d909630ea2bc4015
-
SHA512
f25a05df09421c172c89e6687b3642d3d322628d3f82c6c717574bff7bd6e9890e096ef91cdc447fddf5098eda742559f9e9d3be05b139d3150b433451041753
-
SSDEEP
1536:vByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Wq:+v4JKXTx71wnArSsXFpeXq8Wq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3320 wrote to memory of 712 3320 rundll32.exe 85 PID 3320 wrote to memory of 712 3320 rundll32.exe 85 PID 3320 wrote to memory of 712 3320 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\537c1bda8e48ca0a6d8f738a04dbd6b1a5b64b5dcd72dd44d909630ea2bc4015.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\537c1bda8e48ca0a6d8f738a04dbd6b1a5b64b5dcd72dd44d909630ea2bc4015.dll,#12⤵PID:712
-