Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 01:55
Behavioral task
behavioral1
Sample
44fc719dbe62db69455127114d3d44e7.dll
Resource
win7-20231215-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
44fc719dbe62db69455127114d3d44e7.dll
Resource
win10v2004-20231222-en
3 signatures
150 seconds
General
-
Target
44fc719dbe62db69455127114d3d44e7.dll
-
Size
231KB
-
MD5
44fc719dbe62db69455127114d3d44e7
-
SHA1
ce690b80ed511322a864610ef11c772cf1a117fe
-
SHA256
f2cd979e0e8f8e23a02c596bb3fe1b7cb81010233aeb539bf625a145ce6b0e7a
-
SHA512
a30b5a656792781defddc3243453ac74a3f01f2d40bb9cbd99e62c01f91b585534d8611234a33bf19611e52b7f2b69286bdb205ddc56fcf16803faea48afbf60
-
SSDEEP
6144:OWot1h9lESsrblOPBaKjy/lhGJMVVidEGBCSp/ah:OP9lEvrblesKe/HGIVidEEvch
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/392-0-0x0000000000330000-0x000000000038E000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2764 392 WerFault.exe 15 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3692 wrote to memory of 392 3692 rundll32.exe 15 PID 3692 wrote to memory of 392 3692 rundll32.exe 15 PID 3692 wrote to memory of 392 3692 rundll32.exe 15
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44fc719dbe62db69455127114d3d44e7.dll,#11⤵PID:392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 5762⤵
- Program crash
PID:2764
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44fc719dbe62db69455127114d3d44e7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 392 -ip 3921⤵PID:1512