Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06/08/2021, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll
-
Size
160KB
-
MD5
f782fa626b0c53d9cca2fbb29a65f23f
-
SHA1
9fabc6c255ea94262b6339e4b5949174afd30114
-
SHA256
2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b
-
SHA512
2d023aa899d5025631534489c6a13de071113f36ae2ab32d53c833c749d262019f3c3bd7961f2da12753e389bab92f4bda429662dec77552a13c825258af9e18
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1184 1876 WerFault.exe 25 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1184 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1184 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1208 wrote to memory of 1876 1208 rundll32.exe 25 PID 1208 wrote to memory of 1876 1208 rundll32.exe 25 PID 1208 wrote to memory of 1876 1208 rundll32.exe 25 PID 1208 wrote to memory of 1876 1208 rundll32.exe 25 PID 1208 wrote to memory of 1876 1208 rundll32.exe 25 PID 1208 wrote to memory of 1876 1208 rundll32.exe 25 PID 1208 wrote to memory of 1876 1208 rundll32.exe 25 PID 1876 wrote to memory of 1184 1876 rundll32.exe 27 PID 1876 wrote to memory of 1184 1876 rundll32.exe 27 PID 1876 wrote to memory of 1184 1876 rundll32.exe 27 PID 1876 wrote to memory of 1184 1876 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 2243⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-