Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 02:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c54ac7526b89f7060506fced9a0166f.dll
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c54ac7526b89f7060506fced9a0166f.dll
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
0c54ac7526b89f7060506fced9a0166f.dll
-
Size
7.6MB
-
MD5
0c54ac7526b89f7060506fced9a0166f
-
SHA1
7559246550ef21d5dcca332455bcdd13f29276fd
-
SHA256
8d019680fa6d3957bac91e80ef247031f5de345e93b8f190c1b768c6508ef1c2
-
SHA512
5279b2b7892d0e9dcac861d6761eb71f793976d50583b0c950d18b8896ca868039c4bbdc8c8f76de3ff5c24753c21d2214b096881b3228685d64654fd9fdbde0
-
SSDEEP
196608:+gf60JnP1EYNLGwSzqJ4dUEEyFKKYA/YeVI:+gBJP1Ecwn5ElURVI
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 27 3908 rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4788 3908 WerFault.exe 90 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3908 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4560 wrote to memory of 3908 4560 rundll32.exe 90 PID 4560 wrote to memory of 3908 4560 rundll32.exe 90 PID 4560 wrote to memory of 3908 4560 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c54ac7526b89f7060506fced9a0166f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c54ac7526b89f7060506fced9a0166f.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: RenamesItself
PID:3908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 7843⤵
- Program crash
PID:4788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3908 -ip 39081⤵PID:4980