Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
972e71cceda1e90b825a6a656d92ef6377813a30bc03d2719784be42b950fc59.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
972e71cceda1e90b825a6a656d92ef6377813a30bc03d2719784be42b950fc59.dll
Resource
win10v2004-20240508-en
General
-
Target
972e71cceda1e90b825a6a656d92ef6377813a30bc03d2719784be42b950fc59.dll
-
Size
280KB
-
MD5
1d8e58c1e16aa2a08be35a74b749ba2c
-
SHA1
3625b77ddd36475eb67f67227d7b5cce55615660
-
SHA256
972e71cceda1e90b825a6a656d92ef6377813a30bc03d2719784be42b950fc59
-
SHA512
83f3aa41eef75cceb0df77d3bf7381629955fcc8882cd86b96be584781a495551f3e7bd449874f5d2d578036cd1359700835cc3bde8ba31b619be729ba7e29bb
-
SSDEEP
6144:4Ns8V66ErA1M1862IJ0sxVhC3SEPAQWWe:8VOc1i86msx0RHe
Malware Config
Signatures
-
Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule behavioral2/memory/3548-0-0x000000006ED40000-0x000000006ED86000-memory.dmp suspicious_telegram_bot -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 436 wrote to memory of 3548 436 rundll32.exe 82 PID 436 wrote to memory of 3548 436 rundll32.exe 82 PID 436 wrote to memory of 3548 436 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\972e71cceda1e90b825a6a656d92ef6377813a30bc03d2719784be42b950fc59.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\972e71cceda1e90b825a6a656d92ef6377813a30bc03d2719784be42b950fc59.dll,#12⤵PID:3548
-