Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
48a49dd674ffd9312fe0b46d0d841710_NEAS.dll
Resource
win7-20240220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
48a49dd674ffd9312fe0b46d0d841710_NEAS.dll
Resource
win10v2004-20240419-en
1 signatures
150 seconds
General
-
Target
48a49dd674ffd9312fe0b46d0d841710_NEAS.dll
-
Size
5KB
-
MD5
48a49dd674ffd9312fe0b46d0d841710
-
SHA1
797d06c50bd77953d865015031699a8217f40303
-
SHA256
a02770878f17460816dadc78837e96f59f6513fb8bbc27059b9ed114c8ece566
-
SHA512
79d3915a23d0cc7902992fc3cf96a140b495565e006271a853243e7189f5935ab983182485f22c5ca391a1c55cacaafcbb8908486fa95eb173a83df1c93d6cff
-
SSDEEP
96:nEY2RrF1eqwi402Px8xh+Kv1P7FSnC0KWNTY3b8H78fideA:EHRh1epp02PQP7FgCNWNC8O0T
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 876 wrote to memory of 944 876 rundll32.exe 84 PID 876 wrote to memory of 944 876 rundll32.exe 84 PID 876 wrote to memory of 944 876 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\48a49dd674ffd9312fe0b46d0d841710_NEAS.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\48a49dd674ffd9312fe0b46d0d841710_NEAS.dll,#12⤵PID:944
-