Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 02:10
Behavioral task
behavioral1
Sample
3b9ef19463e18d96f9d65136b3a0a043.dll
Resource
win7-20231129-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
3b9ef19463e18d96f9d65136b3a0a043.dll
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
3b9ef19463e18d96f9d65136b3a0a043.dll
-
Size
32KB
-
MD5
3b9ef19463e18d96f9d65136b3a0a043
-
SHA1
24003bce8a175dd895875f7bfda28486e8e946e0
-
SHA256
401ac3e612cdfbdbd08d8892e520b3d272d8dcf9ffda81d4413c3234329f15ab
-
SHA512
54f2aa44c01c1c81d30476c8d86790ddaf342ae2516d90d02c6140119c7fdc3c8f8d3a59ab88430d5b4c6b19f8822f7cfff00f6f53d789f1a3d4cea253baa6a5
-
SSDEEP
768:QXc/MaoE4Ec5maAVodZ2ubPg7QEuvTq7W0N:WcH4p4aAuP2oEu7qS0
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4072-0-0x0000000010000000-0x0000000010016000-memory.dmp upx behavioral2/memory/4072-1-0x0000000010000000-0x0000000010016000-memory.dmp upx -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2968 4072 WerFault.exe 17 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5040 wrote to memory of 4072 5040 rundll32.exe 17 PID 5040 wrote to memory of 4072 5040 rundll32.exe 17 PID 5040 wrote to memory of 4072 5040 rundll32.exe 17
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b9ef19463e18d96f9d65136b3a0a043.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b9ef19463e18d96f9d65136b3a0a043.dll,#12⤵
- Modifies WinLogon
PID:4072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 7563⤵
- Program crash
PID:2968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4072 -ip 40721⤵PID:1240