Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 05:44
Static task
static1
Behavioral task
behavioral1
Sample
fe27a71fd82c3ec52038791dc227bc3e28db60d0878a7ae07cb9c49323f36bc3.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fe27a71fd82c3ec52038791dc227bc3e28db60d0878a7ae07cb9c49323f36bc3.dll
Resource
win10v2004-20240419-en
General
-
Target
fe27a71fd82c3ec52038791dc227bc3e28db60d0878a7ae07cb9c49323f36bc3.dll
-
Size
5KB
-
MD5
973b06f8bdc3e13a53aff27e323f21d5
-
SHA1
7532a74ea8ce3721beba095f2e91c8b8daf4d6c0
-
SHA256
fe27a71fd82c3ec52038791dc227bc3e28db60d0878a7ae07cb9c49323f36bc3
-
SHA512
1d8a6ac77cdd46efae7395bd995dc2fe1059787a2e367bd16a38b22cd6cab96220c924b6a3076641fd68ae74c90f3d62f4b9f3a992ac16113a64e3ef58bdc7c9
-
SSDEEP
48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqpnnyPToT3EmhK+u6psmsfd7mGisg6IL7gH:hy859x0P8MaBny0ThYqsmsVesxG8v/
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2396 wrote to memory of 1728 2396 rundll32.exe 85 PID 2396 wrote to memory of 1728 2396 rundll32.exe 85 PID 2396 wrote to memory of 1728 2396 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe27a71fd82c3ec52038791dc227bc3e28db60d0878a7ae07cb9c49323f36bc3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe27a71fd82c3ec52038791dc227bc3e28db60d0878a7ae07cb9c49323f36bc3.dll,#12⤵PID:1728
-