Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 00:58
Static task
static1
Behavioral task
behavioral1
Sample
9f444c84a739cbda7dfaa05741ed313697b2f4b4fbf30435271607b990c7eec4.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9f444c84a739cbda7dfaa05741ed313697b2f4b4fbf30435271607b990c7eec4.dll
Resource
win10v2004-20240426-en
General
-
Target
9f444c84a739cbda7dfaa05741ed313697b2f4b4fbf30435271607b990c7eec4.dll
-
Size
4KB
-
MD5
2c4f116286eec71af7e8e806bd60f893
-
SHA1
8262736c12e1f0f5c7f091a3b600454983c33cb5
-
SHA256
9f444c84a739cbda7dfaa05741ed313697b2f4b4fbf30435271607b990c7eec4
-
SHA512
9cd69cfeb65e0ad22884055965fbbf84c484c4f4f3b77ec9107857f96b9c3d0877c65606e23710de2941311ee421e6deea68289527e85725b50a6140322a3213
-
SSDEEP
48:SWkO0IoyTnXz+ihZjoko9Oj3P7Hunaap2YtTWyfef:ZJTnXzvoko9OjfD67EYtXo
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3984 wrote to memory of 5500 3984 rundll32.exe 82 PID 3984 wrote to memory of 5500 3984 rundll32.exe 82 PID 3984 wrote to memory of 5500 3984 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f444c84a739cbda7dfaa05741ed313697b2f4b4fbf30435271607b990c7eec4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f444c84a739cbda7dfaa05741ed313697b2f4b4fbf30435271607b990c7eec4.dll,#12⤵PID:5500
-