Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2023, 08:57
Behavioral task
behavioral1
Sample
NEAS.cbeb89af78888b315b83b61e5c02bdf0_JC.dll
Resource
win7-20231023-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.cbeb89af78888b315b83b61e5c02bdf0_JC.dll
Resource
win10v2004-20231025-en
4 signatures
150 seconds
General
-
Target
NEAS.cbeb89af78888b315b83b61e5c02bdf0_JC.dll
-
Size
76KB
-
MD5
cbeb89af78888b315b83b61e5c02bdf0
-
SHA1
0ac2ac1c810e7e9ef9a97b72a8b68e501ca1ab5c
-
SHA256
491788b90c5dd2de5da996020eef792aa68fd6a20f085dff5558194760c082fe
-
SHA512
b6dab2f1a6c99ddacc171f4476e66d48be78aabe7e590c3fa426daff8b0f570ae4ea61945ebc956f01a7e7e98e9a0779533b6ce63d0b2489a80676733f1651c5
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZekO/W62:c8y93KQjy7G55riF1cMo03okOE
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3328-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3328-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1656 3328 WerFault.exe 82 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3328 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1368 wrote to memory of 3328 1368 rundll32.exe 82 PID 1368 wrote to memory of 3328 1368 rundll32.exe 82 PID 1368 wrote to memory of 3328 1368 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cbeb89af78888b315b83b61e5c02bdf0_JC.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cbeb89af78888b315b83b61e5c02bdf0_JC.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
PID:3328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 7043⤵
- Program crash
PID:1656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3328 -ip 33281⤵PID:1164