Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 13:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53af2f0cf61876f0fc047f1a1b91f81c.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
53af2f0cf61876f0fc047f1a1b91f81c.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
53af2f0cf61876f0fc047f1a1b91f81c.dll
-
Size
92KB
-
MD5
53af2f0cf61876f0fc047f1a1b91f81c
-
SHA1
84629076a9f6931908f3d71a465145736ef58644
-
SHA256
a2d6989b51c067122484a897fbae2cfffa34750180f76d79bc069f2ff6b71c54
-
SHA512
5020b624a9224e126d9052ab9b79e3e9c9cb4c3293df20d0b4d282d8ac51198c5f1b0a165f8e75f5a7d361ae3015016e692dc4fe7feed47a46c11d75e728b8b6
-
SSDEEP
768:AXlmaMvhxrdneStK7vaYXJeMX0D9+2vPZggtWE2HlZdXRO8OxENUhXUUJXlLorAf:N/tV+P3J2vRruvulkjCphXMtFDr2C
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2688 624 WerFault.exe 14 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4412 wrote to memory of 624 4412 rundll32.exe 14 PID 4412 wrote to memory of 624 4412 rundll32.exe 14 PID 4412 wrote to memory of 624 4412 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\53af2f0cf61876f0fc047f1a1b91f81c.dll,#11⤵PID:624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 6322⤵
- Program crash
PID:2688
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\53af2f0cf61876f0fc047f1a1b91f81c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 624 -ip 6241⤵PID:1140