Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
System.Net.WebSockets.Client.dll
Resource
win7-20240221-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
System.Net.WebSockets.Client.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
System.Net.WebSockets.Client.dll
-
Size
62KB
-
MD5
51bdda264b5ef6f7264574fcc697c66b
-
SHA1
7d0d413efefb6745c6be6fddecf072b62f8d9a3a
-
SHA256
a9d027beca6cd28afff71a08224ba47f0b0c9654e643d11d91c5ebc90d206724
-
SHA512
464e25b34d10d6f1d7f90d9dc391ceb5f9f6283320dc2c523195cb56ed6c7807257897fa73c8fd138182e4452d8d75aa19e5001a5f700c6ef1ef7db5b2ea2379
-
SSDEEP
1536:iYecI2Abfo4UcEjIZAq39aceZxXzAOQh2D:iYecIzbA4Uc9BeMOf
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4848 wrote to memory of 1308 4848 rundll32.exe 83 PID 4848 wrote to memory of 1308 4848 rundll32.exe 83 PID 4848 wrote to memory of 1308 4848 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Net.WebSockets.Client.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Net.WebSockets.Client.dll,#12⤵PID:1308
-