Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b.dll
Resource
win10v2004-20240426-en
General
-
Target
e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b.dll
-
Size
6KB
-
MD5
40e172f4bed25a2ec773c217cf112ce2
-
SHA1
3cd003eba77d91a141c2307e66da1ef6bd20a992
-
SHA256
e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b
-
SHA512
38495d2d2a72bec2c294a7e541ba895c30162cfce112cc7066941dfed7eb1915a1a9a0bf1ea7efb05278d74cf87a2ebefd0f2ba42702d6e42c06cbcc0d209b92
-
SSDEEP
48:63mll5YVOa9VUX1iwbQWu03AB+BDq9J5SH:VDa9VUX9bQWXAB+FqX5SH
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2648 3032 rundll32.exe 81 PID 3032 wrote to memory of 2648 3032 rundll32.exe 81 PID 3032 wrote to memory of 2648 3032 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b.dll,#12⤵PID:2648
-