Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
31/05/2024, 21:40
240531-1h99rafc28 831/05/2024, 18:30
240531-w5jcbshf38 831/05/2024, 18:28
240531-w4vc7she97 331/05/2024, 18:26
240531-w3l1fagf5s 8Analysis
-
max time kernel
94s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
31/05/2024, 18:30
General
-
Target
骑士精神2- 整个文件夹解压桌面打开/307.dll
-
Size
45.5MB
-
MD5
17a351a5d2fcdf9beae46bf17b8fd696
-
SHA1
9ddb2fb630a87d00227170e1e6bbc534f8260df6
-
SHA256
aefd0df2f84aabd659a363fa66910d683263d3faeb4e5cd58f63363dd1662de0
-
SHA512
6adbd992bbf7284faf285445d55e61709e9f9e9939dd86ac78dad4d941bdf6f1702150bc7111a5f7637c9ecd9179bc883d4d2e9a7674710d4bae24e5f4cf157a
-
SSDEEP
786432:BoMdRenWHSRTPyxn2JYH1LBpqCJvnPnljhVeWdaKN+mqpq+vyJmVq4:BoMdRenAwPy4WVFpLJvnvlNV1dzZ+vye
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\骑士精神2- 整个文件夹解压桌面打开\307.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\骑士精神2- 整个文件夹解压桌面打开\307.dll",#12⤵
- Blocklisted process makes network request
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60.8MB
-
Filesize
428KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
60.8MB