Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 05:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08706451a23006d83dddad783a8294cf.dll
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
08706451a23006d83dddad783a8294cf.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
08706451a23006d83dddad783a8294cf.dll
-
Size
944KB
-
MD5
08706451a23006d83dddad783a8294cf
-
SHA1
f6e5eecff8b6a1b240e3c0c4f56878060fa6e07c
-
SHA256
63e9f9e80d9aa9b8511c01c1d4897e8c6041b758699dabf8b993e14d8868d092
-
SHA512
72b7d0b69b549c994c47e376ffb9d35c72b60f21d1899c60017b73af7f423681d29981aa8ad46c4cc84f3d89e24060d097975671b2fd13d6896c165993ee01e4
-
SSDEEP
24576:MfsTsvYLPBZQXcFMiOWmQWU2mSMkDROJ3dztk8XCg:nDOFmuROJ7C
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1552 1544 WerFault.exe 14 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4144 wrote to memory of 1544 4144 rundll32.exe 14 PID 4144 wrote to memory of 1544 4144 rundll32.exe 14 PID 4144 wrote to memory of 1544 4144 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08706451a23006d83dddad783a8294cf.dll,#11⤵PID:1544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 6802⤵
- Program crash
PID:1552
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08706451a23006d83dddad783a8294cf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1544 -ip 15441⤵PID:4336