Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll
Resource
win10v2004-20240426-en
General
-
Target
2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll
-
Size
612KB
-
MD5
bba63b02068f72bb9338db22c470b2ed
-
SHA1
36c115e8bc3a817a6bd2a6105fe3f3b7f6b735ac
-
SHA256
2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50
-
SHA512
eb757ff55f8e1a8ebcf2757912381aa64626ea4fd5af3fdcb05256f120c7f68ac0ff6016044629cb8ed52886492bd387644400a2f143a4ff54e95e6a8c92d21c
-
SSDEEP
6144:YYHojk/imorOWn47GxtRFSFEogZvxiVDYBKcTDZ5K1BMCkUlxgByAMGByNr2nq:VIZmorznxxtRF6eFBXXK8mxgBIyq
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3728 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3052 wrote to memory of 3728 3052 rundll32.exe 82 PID 3052 wrote to memory of 3728 3052 rundll32.exe 82 PID 3052 wrote to memory of 3728 3052 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:3728
-