Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 11:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19dc913aecd0d4203f06a1f7f0fdf550.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
19dc913aecd0d4203f06a1f7f0fdf550.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
19dc913aecd0d4203f06a1f7f0fdf550.dll
-
Size
320KB
-
MD5
19dc913aecd0d4203f06a1f7f0fdf550
-
SHA1
bac93ffcbac5b08ccec926738d46c5933b4ac029
-
SHA256
7b9649c0bf2699b29c57d9071a22f455c52a873572c7441411ec1f035ae55d2f
-
SHA512
5532faff95b85a5871a18c29e69ed7ed774fd58398c67ef07017e6bf0b772535092d803ba7eb96156e9162bc73156b50256977dd435d8e174a19df154589dcaa
-
SSDEEP
6144:SyMWrs0O3ZIVa3PR4zuO6M/xt7DLA/Gz99wvd0qB:CWrPlVs5fO6Mpt74/G9Rq
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 5088 1964 WerFault.exe 88 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4440 wrote to memory of 1964 4440 rundll32.exe 88 PID 4440 wrote to memory of 1964 4440 rundll32.exe 88 PID 4440 wrote to memory of 1964 4440 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19dc913aecd0d4203f06a1f7f0fdf550.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19dc913aecd0d4203f06a1f7f0fdf550.dll,#12⤵PID:1964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 5883⤵
- Program crash
PID:5088
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1964 -ip 19641⤵PID:3904