Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
168s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b.dll
Resource
win10v2004-20231215-en
General
-
Target
f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b.dll
-
Size
397KB
-
MD5
b700be3adbe30c3124c0657f85803924
-
SHA1
9342e8b905c694ff29a66ab1d848f5038c23094d
-
SHA256
f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b
-
SHA512
30a4ad7ebe084565b4f0b744659b06a7541618c23b2cbda7911f21367d0ab265d28230ad87060575a7a14b667fd44e37be5896665bd96545d88f0c181acf66f2
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOap:174g2LDeiPDImOkx2LIap
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3648 2240 WerFault.exe 89 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2240 rundll32.exe 2240 rundll32.exe 2240 rundll32.exe 2240 rundll32.exe 2240 rundll32.exe 2240 rundll32.exe 2240 rundll32.exe 2240 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2240 rundll32.exe Token: SeTcbPrivilege 2240 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 828 wrote to memory of 2240 828 rundll32.exe 89 PID 828 wrote to memory of 2240 828 rundll32.exe 89 PID 828 wrote to memory of 2240 828 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 7163⤵
- Program crash
PID:3648
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2240 -ip 22401⤵PID:2576