Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 21:13
Behavioral task
behavioral1
Sample
f8825b22a2ce9b0bc71e1e4bd4856e7f.dll
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f8825b22a2ce9b0bc71e1e4bd4856e7f.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
f8825b22a2ce9b0bc71e1e4bd4856e7f.dll
-
Size
1.0MB
-
MD5
f8825b22a2ce9b0bc71e1e4bd4856e7f
-
SHA1
cd9636ec64b182ab32bd812e494d9b9e6adf9976
-
SHA256
5cce7edf03dcde21fc0330213930edeec1ae4118130cf9d0af2757812980be58
-
SHA512
ef07c735d3d3754b5364bbd6abf58590747f9e85a1434d2c5a9cc664b5b3f7e2421f28afdd3532b6e3a5f03c8c6e7b99a599abb9baca8355a596fbf51d015387
-
SSDEEP
24576:DiPtyOE7oU5+Buxi5TFKBDtO24N+ioS8SeCGCD+D:S87Xi5TkHO24N+S8Oy
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4068-0-0x0000000074C10000-0x0000000074E67000-memory.dmp upx behavioral2/memory/4068-1-0x0000000074C10000-0x0000000074E67000-memory.dmp upx behavioral2/memory/4068-3-0x0000000074C10000-0x0000000074E67000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3776 4068 WerFault.exe 90 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1952 wrote to memory of 4068 1952 rundll32.exe 90 PID 1952 wrote to memory of 4068 1952 rundll32.exe 90 PID 1952 wrote to memory of 4068 1952 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8825b22a2ce9b0bc71e1e4bd4856e7f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8825b22a2ce9b0bc71e1e4bd4856e7f.dll,#12⤵PID:4068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 8803⤵
- Program crash
PID:3776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4068 -ip 40681⤵PID:3500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4068 -ip 40681⤵PID:2076