Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 05:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2984d50754f3f00bfa3cbcc855e11d18.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2984d50754f3f00bfa3cbcc855e11d18.dll
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
2984d50754f3f00bfa3cbcc855e11d18.dll
-
Size
91KB
-
MD5
2984d50754f3f00bfa3cbcc855e11d18
-
SHA1
74f90d3df26cebce914d9e2d3187902b6c77e9f9
-
SHA256
0efb1db102634ace93f77fedd45a6da7f8cb582882f5d7cd88c5ca04660687bf
-
SHA512
6714b42aabf0454e442b881f0b3122d6bab4b1e8b5866ed188be023df243b92e4b5d3ff5ac179b41b2f2467fdbe26b6776dbe30d416fe5df063b0c2a3c3756b6
-
SSDEEP
1536:WsMwhk7sW8+beD1/M9S8N8b8w2p5NKaCg:Wrpu0Yy6ww2p5Nag
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2988 3812 WerFault.exe 16 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4816 wrote to memory of 3812 4816 rundll32.exe 16 PID 4816 wrote to memory of 3812 4816 rundll32.exe 16 PID 4816 wrote to memory of 3812 4816 rundll32.exe 16
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2984d50754f3f00bfa3cbcc855e11d18.dll,#11⤵PID:3812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 6282⤵
- Program crash
PID:2988
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2984d50754f3f00bfa3cbcc855e11d18.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3812 -ip 38121⤵PID:4168