Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 22:55
Static task
static1
Behavioral task
behavioral1
Sample
fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e.dll
Resource
win10v2004-20240709-en
General
-
Target
fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e.dll
-
Size
6.2MB
-
MD5
a663ce598d8a56e0ca456703d721f256
-
SHA1
ecd233207007a00cdec3da429cfefea9d1e61a4b
-
SHA256
fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e
-
SHA512
bd1d3c4c9b212278e869c5f10ff21d574168def53c062ffdda411ef603e9085d380760fa365816833ccbea49225537d9388466167964dc060c89b6bd65710205
-
SSDEEP
49152:TLffoJlkBlx7qmX0lPFgPT8I7fhQh2dERd9Twr3En6U3cljx0B1mHK1vQtQndFX+:TLYJsNzWN48IjhQu3t
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3452 wrote to memory of 732 3452 rundll32.exe 84 PID 3452 wrote to memory of 732 3452 rundll32.exe 84 PID 3452 wrote to memory of 732 3452 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e.dll,#12⤵PID:732
-