Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
16/11/2023, 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.e59586f3de8a7021caa8bdfdbb4eea30.dll
Resource
win7-20231020-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.e59586f3de8a7021caa8bdfdbb4eea30.dll
Resource
win10v2004-20231020-en
2 signatures
150 seconds
General
-
Target
NEAS.e59586f3de8a7021caa8bdfdbb4eea30.dll
-
Size
1.5MB
-
MD5
e59586f3de8a7021caa8bdfdbb4eea30
-
SHA1
53e2d1283f29ed8760ebbfd91687ad232201ed66
-
SHA256
9d024a374e7e65f48030504e7fee7cfd2e0168d94a007e33d742d81af31beddf
-
SHA512
d5030bdc3c4ed0dfeada3b586bf31b603de3d7ab3957ade57148fd709f17652b435ad6e31409603e218f07314f6ddacf5865cffafd0376e7a4f569e4d138428d
-
SSDEEP
49152:P/rrEiicsc8ZzIVn3RXhee7jO4Yuz4OMYC2F:PMiiLcPnB8ePyO82F
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4256 5032 WerFault.exe 86 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3304 wrote to memory of 5032 3304 rundll32.exe 86 PID 3304 wrote to memory of 5032 3304 rundll32.exe 86 PID 3304 wrote to memory of 5032 3304 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.e59586f3de8a7021caa8bdfdbb4eea30.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.e59586f3de8a7021caa8bdfdbb4eea30.dll,#12⤵PID:5032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 5643⤵
- Program crash
PID:4256
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5032 -ip 50321⤵PID:3676