Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
15 NOTIFICA......exe
windows7-x64
105 NOTIFICA......exe
windows10-2004-x64
105 NOTIFICA...er.dll
windows7-x64
15 NOTIFICA...er.dll
windows10-2004-x64
15 NOTIFICA...20.dll
windows7-x64
15 NOTIFICA...20.dll
windows10-2004-x64
15 NOTIFICA...20.dll
windows7-x64
15 NOTIFICA...20.dll
windows10-2004-x64
1Analysis
-
max time kernel
66s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
5 NOTIFICACION DEMANDA/5 NOTIFICACION DEMANDA...exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5 NOTIFICACION DEMANDA/5 NOTIFICACION DEMANDA...exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
5 NOTIFICACION DEMANDA/Register.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
5 NOTIFICACION DEMANDA/Register.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
5 NOTIFICACION DEMANDA/rtl120.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
5 NOTIFICACION DEMANDA/rtl120.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
5 NOTIFICACION DEMANDA/vcl120.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
5 NOTIFICACION DEMANDA/vcl120.dll
Resource
win10v2004-20240226-en
General
-
Target
5 NOTIFICACION DEMANDA/rtl120.dll
-
Size
1.1MB
-
MD5
adf82ed333fb5567f8097c7235b0e17f
-
SHA1
e6ccaf016fc45edcdadeb40da64c207ddb33859f
-
SHA256
d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50
-
SHA512
2253c7b51317a3b5734025b6c7639105dbc81c340703718d679a00c13d40dd74ccaba1f6d04b21ee440f19e82ba680aa4b2a6a75c618aed91bd85a132be9fc92
-
SSDEEP
24576:GbhVoNWbA1m6z1hGaMopv3RdaK6IPFf0DtDN9Tox0gc:vtQZPTtgc
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3984 wrote to memory of 624 3984 rundll32.exe 85 PID 3984 wrote to memory of 624 3984 rundll32.exe 85 PID 3984 wrote to memory of 624 3984 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\5 NOTIFICACION DEMANDA\rtl120.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\5 NOTIFICACION DEMANDA\rtl120.dll",#12⤵PID:624
-