Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 11:56
Behavioral task
behavioral1
Sample
17bad077379cd959607cd0765c1da797.dll
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
17bad077379cd959607cd0765c1da797.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
17bad077379cd959607cd0765c1da797.dll
-
Size
70KB
-
MD5
17bad077379cd959607cd0765c1da797
-
SHA1
505b6ec21bd41eca0ed96f832f64ef33e2b29bbe
-
SHA256
3a789a9834c4e1b42d7c8dff019fc58ae7ece70554ab16ff3610d22ddee3fd3a
-
SHA512
770f582baa762f22beee98ded16267756ab1aaef692db5f6a07c333c42eacb8d6d18ba0048738a03122c43b071b00f70bac83db96ef750b9d95e683bb85e08a6
-
SSDEEP
1536:1XLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77Gnout:1XLwt/FiaU1Uq/dWFbNr8azD7VS372oS
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3688-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3688-1-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3688-4-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Program crash 2 IoCs
pid pid_target Process procid_target 4596 3688 WerFault.exe 89 4768 3688 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4744 wrote to memory of 3688 4744 regsvr32.exe 89 PID 4744 wrote to memory of 3688 4744 regsvr32.exe 89 PID 4744 wrote to memory of 3688 4744 regsvr32.exe 89 PID 3688 wrote to memory of 4596 3688 regsvr32.exe 93 PID 3688 wrote to memory of 4596 3688 regsvr32.exe 93 PID 3688 wrote to memory of 4596 3688 regsvr32.exe 93
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\17bad077379cd959607cd0765c1da797.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\17bad077379cd959607cd0765c1da797.dll2⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 6603⤵
- Program crash
PID:4596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 6603⤵
- Program crash
PID:4768
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3688 -ip 36881⤵PID:3656