Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
168s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 04:59
Static task
static1
Behavioral task
behavioral1
Sample
015394aba2478c13c6fa975886545673ddddbae3720be2a7aa7dfcc3edc16e8f.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
015394aba2478c13c6fa975886545673ddddbae3720be2a7aa7dfcc3edc16e8f.dll
Resource
win10v2004-20230915-en
General
-
Target
015394aba2478c13c6fa975886545673ddddbae3720be2a7aa7dfcc3edc16e8f.dll
-
Size
2.1MB
-
MD5
3dd3109bc47a25c4eece76830e8771ec
-
SHA1
d430f1016c86824405fc44fad3d654dc36602d77
-
SHA256
015394aba2478c13c6fa975886545673ddddbae3720be2a7aa7dfcc3edc16e8f
-
SHA512
91a53f764de194aae3dc80fee8899fb14b54703cf6a889f65d9108beae0e9eaa80a63324f42b7e33c5a28e07ff608f3fdb8b3f8ca71dd132986baa7c1352ea4f
-
SSDEEP
49152:vcz84B8m/mJaQAXJmFmEfZOkNPSTqctjRTDpJMMH:k7qm/MMcbPSTqsL5H
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2744 3232 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5084 wrote to memory of 3232 5084 rundll32.exe 85 PID 5084 wrote to memory of 3232 5084 rundll32.exe 85 PID 5084 wrote to memory of 3232 5084 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\015394aba2478c13c6fa975886545673ddddbae3720be2a7aa7dfcc3edc16e8f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\015394aba2478c13c6fa975886545673ddddbae3720be2a7aa7dfcc3edc16e8f.dll,#12⤵PID:3232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 5603⤵
- Program crash
PID:2744
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3232 -ip 32321⤵PID:4284