Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47f5352276783b2277f44ee167921d2f.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
47f5352276783b2277f44ee167921d2f.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
47f5352276783b2277f44ee167921d2f.dll
-
Size
44KB
-
MD5
47f5352276783b2277f44ee167921d2f
-
SHA1
7daa65c22ca98c277843968d4845f256437dc8b2
-
SHA256
acef7f0681bedb4a635e4d4d2e97b4030d27cf36be76a5c4eb1f3f400368c92a
-
SHA512
ec780ca50bf78084de03828b99814b26a870861541794038975181c7b638b40f3f36ec7b0ebb1bb0a1980f935af3901bd37f9cbbf09847baeed25e1aa87b6cce
-
SSDEEP
768:W+2/zx9VtqkFK4esvXFHQ+W2Rq4mbzhITRFI3WtC1:WZzDquKtEwZ2Rq4mfhITRFIp
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4528 3700 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3708 wrote to memory of 3700 3708 rundll32.exe 89 PID 3708 wrote to memory of 3700 3708 rundll32.exe 89 PID 3708 wrote to memory of 3700 3708 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\47f5352276783b2277f44ee167921d2f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\47f5352276783b2277f44ee167921d2f.dll,#12⤵PID:3700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 5603⤵
- Program crash
PID:4528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3700 -ip 37001⤵PID:4784