Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
21s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06/08/2021, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll
-
Size
127KB
-
MD5
ee233e16958768992086207345e84556
-
SHA1
7647ac35b342f27ee51407ed63fa680b20b8fafb
-
SHA256
24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0
-
SHA512
a530d2533ae761a183404130372c4b06514c06224f491cdc5c32694c355413531d29ccc56e2ca6d4b47442fb4ffb5457d5ce53ee89a2a6f4e2a9d5c0a4252de3
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3720 1404 WerFault.exe 70 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe 3720 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3720 WerFault.exe Token: SeBackupPrivilege 3720 WerFault.exe Token: SeDebugPrivilege 3720 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 516 wrote to memory of 1404 516 rundll32.exe 70 PID 516 wrote to memory of 1404 516 rundll32.exe 70 PID 516 wrote to memory of 1404 516 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll,#12⤵PID:1404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 6203⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3720
-
-