Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 05:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08271cb6d7e36dbd7a6158203f976c4f.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
08271cb6d7e36dbd7a6158203f976c4f.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
08271cb6d7e36dbd7a6158203f976c4f.dll
-
Size
366KB
-
MD5
08271cb6d7e36dbd7a6158203f976c4f
-
SHA1
7ed35d87094d0b77416d10336cce24b8b60aa7d9
-
SHA256
54f00b204f4c94c1535b68571312f2f98427d5b05aa5fcb96f2ce6e620e2cc62
-
SHA512
3c3f0d19182b07c8b07c60bfa861bc3c91f3f19126992e680f15f5958da16fcbc6517d435d8b6ed91556958a047512aa14c612f4efa4c6a5387a6270b560d38f
-
SSDEEP
6144:fwM3I4nEYm2WLZz9PGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyQ3t:4kI4nJmRz9PGGjkrgoN9Ppymfkn0
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4140 3772 WerFault.exe 17 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5072 wrote to memory of 3772 5072 rundll32.exe 17 PID 5072 wrote to memory of 3772 5072 rundll32.exe 17 PID 5072 wrote to memory of 3772 5072 rundll32.exe 17
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08271cb6d7e36dbd7a6158203f976c4f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08271cb6d7e36dbd7a6158203f976c4f.dll,#12⤵PID:3772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 5963⤵
- Program crash
PID:4140
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3772 -ip 37721⤵PID:5076