Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 18:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46e62f9367d5027c29ee93e28fa85bf8.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
46e62f9367d5027c29ee93e28fa85bf8.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
46e62f9367d5027c29ee93e28fa85bf8.dll
-
Size
158KB
-
MD5
46e62f9367d5027c29ee93e28fa85bf8
-
SHA1
26a6e38a1a3937317d34a5a4147899fdc7395269
-
SHA256
b56b2e88ed056a6fe257838c691ed43bc6dd08fd8edc5884b0c515926f5ed00c
-
SHA512
24e5b0f9f986c49a55bdc3af6cea26e646ef53c3ea8376b2e9b63f2e507995a08b2bf946203683e095994c6a83a05d21f0d28914531f8c9a1ea8df8159f0e4db
-
SSDEEP
3072:tRSJNcL/yvKEszUbt//B8xd9SQ7ykDASIG4:eDcLaYa//B6AQe8
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2160 1384 WerFault.exe 88 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1648 wrote to memory of 1384 1648 regsvr32.exe 88 PID 1648 wrote to memory of 1384 1648 regsvr32.exe 88 PID 1648 wrote to memory of 1384 1648 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\46e62f9367d5027c29ee93e28fa85bf8.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\46e62f9367d5027c29ee93e28fa85bf8.dll2⤵PID:1384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 6043⤵
- Program crash
PID:2160
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1384 -ip 13841⤵PID:4596