Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 13:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3741cb76a879c4890e5382d6f83559c2.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
3741cb76a879c4890e5382d6f83559c2.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
3741cb76a879c4890e5382d6f83559c2.dll
-
Size
72KB
-
MD5
3741cb76a879c4890e5382d6f83559c2
-
SHA1
304262c572fd51d3e4c43a49853896e8ba93ca72
-
SHA256
91d3da777b48c0d8638a971aa6ad1d8da2cd4d3c912157bad4be315b3b3196d0
-
SHA512
27062aefaba95bb3521244fb46de5f03e9377e8feb765b82fa6d1fdea7852a566eb160ff0728586dc4a0c2f1f4097977e52e5feafaaba5d7a9b11784e3763473
-
SSDEEP
1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 5052 1816 WerFault.exe 90 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4716 wrote to memory of 1816 4716 rundll32.exe 90 PID 4716 wrote to memory of 1816 4716 rundll32.exe 90 PID 4716 wrote to memory of 1816 4716 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3741cb76a879c4890e5382d6f83559c2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3741cb76a879c4890e5382d6f83559c2.dll,#12⤵PID:1816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 6003⤵
- Program crash
PID:5052
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1816 -ip 18161⤵PID:216