Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
67s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
22/05/2023, 15:51
General
-
Target
G_768916/DVolPro.dll
-
Size
8.0MB
-
MD5
30e1d0c1941167612a1da0bb79a03be8
-
SHA1
705e76d20627f5b19d8c08cb7bcab0e04a962c8a
-
SHA256
01fd9d0fefc8a123f59347eb48de14336d641b22440ba20b6724f506b0a892ad
-
SHA512
8084e4e805e5b458d04e6e246a29b45478fde661c16a34a8f77846174b869e06df861b69a1c4a76b91c9e3c07842a21c0b21da7f9aa1e2952ec7b15a2886ad26
-
SSDEEP
196608:MqwXvaXu8N9GEFH20R85wLIhiNz6aWSzJUovW:6AH2I8czN+tSzJxW
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\G_768916\DVolPro.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\G_768916\DVolPro.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 5923⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
14.2MB