Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 22:19
Static task
static1
Behavioral task
behavioral1
Sample
3a6bdac4f32e8d24158e550c3dcab766e0b105916a2e47aed20aee20dbfd7ec4.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3a6bdac4f32e8d24158e550c3dcab766e0b105916a2e47aed20aee20dbfd7ec4.dll
Resource
win10v2004-20240508-en
General
-
Target
3a6bdac4f32e8d24158e550c3dcab766e0b105916a2e47aed20aee20dbfd7ec4.dll
-
Size
1.6MB
-
MD5
4dbbd7a5338af18d8b15e948a2b540f7
-
SHA1
be049f302f7c89abc81ad4ac9a415992bca4aa7f
-
SHA256
3a6bdac4f32e8d24158e550c3dcab766e0b105916a2e47aed20aee20dbfd7ec4
-
SHA512
5529063377ddcdca7ffb7975e5f70a0855f9bf800dc1f8667e36b0ce86f59800602e2cf8e0db7e1b485415cdd2549d1815d293d7ff51184cf41f30794e1e259b
-
SSDEEP
24576:cvh2ggAeJxDa1PbaNahWwKMZ6hL72HUI88csv:ZyGxDa1jYgWwj0L72+85
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4608 wrote to memory of 4816 4608 rundll32.exe 81 PID 4608 wrote to memory of 4816 4608 rundll32.exe 81 PID 4608 wrote to memory of 4816 4608 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6bdac4f32e8d24158e550c3dcab766e0b105916a2e47aed20aee20dbfd7ec4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6bdac4f32e8d24158e550c3dcab766e0b105916a2e47aed20aee20dbfd7ec4.dll,#12⤵PID:4816
-