Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 02:19
Behavioral task
behavioral1
Sample
820e73e86b2ae5e5af78678c52fa3485455d98a81622424776add7156dcf786c.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
820e73e86b2ae5e5af78678c52fa3485455d98a81622424776add7156dcf786c.dll
Resource
win10v2004-20231215-en
General
-
Target
820e73e86b2ae5e5af78678c52fa3485455d98a81622424776add7156dcf786c.dll
-
Size
269KB
-
MD5
7786860188783628d0ae82f75ab66c91
-
SHA1
58bd068c17b0f1d172c295f77e76ccdf5b011605
-
SHA256
820e73e86b2ae5e5af78678c52fa3485455d98a81622424776add7156dcf786c
-
SHA512
07023e2a1a5d2c8cb62641e65b3a5d93e686467c4d06a11121be4a6bb8b3bc223f2489dcd6bf80176d695a02b256be765df5a255b3611fcb980cf1685ac3c4d0
-
SSDEEP
6144:+RR5rhZFQGrsUwF7vlPoSsG5ruTPTMMlk5F4D:+R5nWFpPoSTED
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2924-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2924-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2924-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2924-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2924-4-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 4128 2924 WerFault.exe 88 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2924 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2924 2140 rundll32.exe 88 PID 2140 wrote to memory of 2924 2140 rundll32.exe 88 PID 2140 wrote to memory of 2924 2140 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\820e73e86b2ae5e5af78678c52fa3485455d98a81622424776add7156dcf786c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\820e73e86b2ae5e5af78678c52fa3485455d98a81622424776add7156dcf786c.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 6443⤵
- Program crash
PID:4128
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2924 -ip 29241⤵PID:3612