Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06/08/2021, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll
-
Size
127KB
-
MD5
ee233e16958768992086207345e84556
-
SHA1
7647ac35b342f27ee51407ed63fa680b20b8fafb
-
SHA256
24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0
-
SHA512
a530d2533ae761a183404130372c4b06514c06224f491cdc5c32694c355413531d29ccc56e2ca6d4b47442fb4ffb5457d5ce53ee89a2a6f4e2a9d5c0a4252de3
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2040 2036 WerFault.exe 25 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2040 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2040 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1104 wrote to memory of 2036 1104 rundll32.exe 25 PID 1104 wrote to memory of 2036 1104 rundll32.exe 25 PID 1104 wrote to memory of 2036 1104 rundll32.exe 25 PID 1104 wrote to memory of 2036 1104 rundll32.exe 25 PID 1104 wrote to memory of 2036 1104 rundll32.exe 25 PID 1104 wrote to memory of 2036 1104 rundll32.exe 25 PID 1104 wrote to memory of 2036 1104 rundll32.exe 25 PID 2036 wrote to memory of 2040 2036 rundll32.exe 27 PID 2036 wrote to memory of 2040 2036 rundll32.exe 27 PID 2036 wrote to memory of 2040 2036 rundll32.exe 27 PID 2036 wrote to memory of 2040 2036 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 2243⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-