Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 16:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c1a3ca465d8eb7488bf5a84263b82ce.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
7c1a3ca465d8eb7488bf5a84263b82ce.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
7c1a3ca465d8eb7488bf5a84263b82ce.dll
-
Size
106KB
-
MD5
7c1a3ca465d8eb7488bf5a84263b82ce
-
SHA1
e97b4e8a881778613d20acff19dfdcc4a87669de
-
SHA256
c57f650774fd7efc520d4c63a387b8c6aeaa6eccd6cdbf4f32ca6696839df159
-
SHA512
c3cf4b96e23c433b62d1b8d97a37c2d1cdeaa533010e381d1e8ba6312d557dd867710540a713b38a585c342e5f450a96dd111be0a8b929a234c4f2fb3be4b7b9
-
SSDEEP
1536:TjqIKDSvaTBH/FDpEfCoOe3q6o6yQKYdv5jQKuGG5naq6pFnJDYxtueV9jiH9ad:l8SvaVtpoOeZisjQKuGtDYx4wzd
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3408 4616 WerFault.exe 36 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4520 wrote to memory of 4616 4520 rundll32.exe 36 PID 4520 wrote to memory of 4616 4520 rundll32.exe 36 PID 4520 wrote to memory of 4616 4520 rundll32.exe 36
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c1a3ca465d8eb7488bf5a84263b82ce.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c1a3ca465d8eb7488bf5a84263b82ce.dll,#12⤵PID:4616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 6403⤵
- Program crash
PID:3408
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4616 -ip 46161⤵PID:1760