Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2022, 08:46
Behavioral task
behavioral1
Sample
864-58-0x00000000001B0000-0x00000000001DA000-memory.dll
Resource
win7-20220901-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
864-58-0x00000000001B0000-0x00000000001DA000-memory.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
864-58-0x00000000001B0000-0x00000000001DA000-memory.dll
-
Size
168KB
-
MD5
2b72fac5dcd50453bb9e0f6c9cd8623d
-
SHA1
bd028ca739766e30b5b5d45f8e2943c3682664fc
-
SHA256
2060a1976bee37ede8da81a69e3e4248271744dd58c800055e5328aca671a4ec
-
SHA512
ecc9c7623fea256eb36e56ba9149379712bf9c19947c34ec6cbbc8c85980ba0ba5bfc46d6394d920a11359ce4e25a63212861ea5db843769925fe99280b2a492
-
SSDEEP
3072:k/BLkyzwtNie/8XzAgJaGtV8TBfFZgUiO/yaxX1:8sae/8X0gJjtV8TB9ZT9/
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 5100 2752 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1268 wrote to memory of 2752 1268 rundll32.exe 81 PID 1268 wrote to memory of 2752 1268 rundll32.exe 81 PID 1268 wrote to memory of 2752 1268 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\864-58-0x00000000001B0000-0x00000000001DA000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\864-58-0x00000000001B0000-0x00000000001DA000-memory.dll,#12⤵PID:2752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 5643⤵
- Program crash
PID:5100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2752 -ip 27521⤵PID:3044