Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 20:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
03b066246003814bde75b991b45208c8.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
03b066246003814bde75b991b45208c8.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
03b066246003814bde75b991b45208c8.dll
-
Size
99KB
-
MD5
03b066246003814bde75b991b45208c8
-
SHA1
cc68211c3f5db2c23d2f54433f41a18e22bcbc6c
-
SHA256
d4720fbadd18ebce1c854925d8bc71d6772f9855773b7fa5260f1817a19bad21
-
SHA512
1e62b4493f45cc1bba947f850f18f9fa6460267ea130082a3216437200126eec8343385e88afaccd53ab53eac1e3276c5994f56ad29d89d2e944cbd70c755f03
-
SSDEEP
3072:/501wxblRZ/RVXVdMvxFQLvHvtiW2MSK:/9xjxbMxWLvHc
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 664 744 WerFault.exe 15 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4696 wrote to memory of 744 4696 regsvr32.exe 15 PID 4696 wrote to memory of 744 4696 regsvr32.exe 15 PID 4696 wrote to memory of 744 4696 regsvr32.exe 15
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\03b066246003814bde75b991b45208c8.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\03b066246003814bde75b991b45208c8.dll2⤵PID:744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 6163⤵
- Program crash
PID:664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 744 -ip 7441⤵PID:2548