Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 11:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17185c1955d4a71e3a350195f00be0ca.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
17185c1955d4a71e3a350195f00be0ca.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
17185c1955d4a71e3a350195f00be0ca.dll
-
Size
167KB
-
MD5
17185c1955d4a71e3a350195f00be0ca
-
SHA1
5b6efabb744ca04ea7cef69b39f1c83d02cec5c0
-
SHA256
954ee5eeee4dce284309528e850dd4260fe0c1558617376935262c9ac4f39885
-
SHA512
d2c59d25de8ecfd7363aa7f770433906a69a43a346d130da89de124e19dd9604973772a722a1c85c2b663206204b51eb03cdfc2a4537cc4e80a0dcef246d4ab7
-
SSDEEP
3072:XfpKUplkG+dvnqUxHkHpDDV3TRSFW4jx99/DM:X02V+dv/xEHnd1ux99/
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 116 3652 WerFault.exe 15 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4272 wrote to memory of 3652 4272 regsvr32.exe 15 PID 4272 wrote to memory of 3652 4272 regsvr32.exe 15 PID 4272 wrote to memory of 3652 4272 regsvr32.exe 15
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\17185c1955d4a71e3a350195f00be0ca.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\17185c1955d4a71e3a350195f00be0ca.dll2⤵PID:3652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 5963⤵
- Program crash
PID:116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3652 -ip 36521⤵PID:4716