Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll
Resource
win10v2004-20240426-en
General
-
Target
020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll
-
Size
168KB
-
MD5
12a7dcb3056ec47f82a6571ae2f401b6
-
SHA1
661bd039fe812723adb21f36e582b5cf0272f3e7
-
SHA256
020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9
-
SHA512
5a21b8706372df3fc6b7bcba823b82c7ff89ad6d5f2dd51ecebf25dcd68f8ac7667f8fdd8e5c08334f1c082a3f088a8aee4050ac7aad1a9dbde7fc63beacb03c
-
SSDEEP
3072:mnL5U9mOXm6Tw1zwk1LFAkA1cMco9wYfScAoZ:sUHTwVwkPALHWq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3500 wrote to memory of 3228 3500 rundll32.exe 82 PID 3500 wrote to memory of 3228 3500 rundll32.exe 82 PID 3500 wrote to memory of 3228 3500 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll,#12⤵PID:3228
-