Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll
Resource
win10v2004-20231222-en
General
-
Target
8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll
-
Size
397KB
-
MD5
efcec2128711aca7aa018b62ae5e765d
-
SHA1
36888f07b008868b31aafb6d1449ec64b2fbf26d
-
SHA256
8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79
-
SHA512
37e72d7bd6d8e917f959e5103d53d571d9dd56ae63149ffd0fc6b7e11896d09a8b67e5325dfab08add2acf527a9ec73291b6d8ac64144cf1b9345efc26454697
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaI:174g2LDeiPDImOkx2LIaI
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1464 1904 WerFault.exe 14 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1904 rundll32.exe Token: SeTcbPrivilege 1904 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5028 wrote to memory of 1904 5028 rundll32.exe 14 PID 5028 wrote to memory of 1904 5028 rundll32.exe 14 PID 5028 wrote to memory of 1904 5028 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 7282⤵
- Program crash
PID:1464
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1904 -ip 19041⤵PID:2852