Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 04:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a519576ea18d75580a1343f8e32cb83.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a519576ea18d75580a1343f8e32cb83.dll
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
5a519576ea18d75580a1343f8e32cb83.dll
-
Size
29KB
-
MD5
5a519576ea18d75580a1343f8e32cb83
-
SHA1
9cb7ca350fbd67c869bb3c93fbef2e3b14089379
-
SHA256
99c7b17585f32eb0a55c5ec61513234ce70432c726a9b5625ec62d3d3055d54f
-
SHA512
6f5deae4d7165e8acde94b83fcfa4c9b6e0a490d44824d033a234afdb3ccaca80a5c6c575ebb301c9f02dd93836b76df609f8ed1075da148c3eb73fa635e057a
-
SSDEEP
768:4mlX9clAdXCVrIRxExd/aqdAkqNGRbZIgXBCFoaGh:4UkVrmqd/aUAkqsRbaY
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1996 1748 WerFault.exe 56 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1464 wrote to memory of 1748 1464 rundll32.exe 56 PID 1464 wrote to memory of 1748 1464 rundll32.exe 56 PID 1464 wrote to memory of 1748 1464 rundll32.exe 56
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a519576ea18d75580a1343f8e32cb83.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a519576ea18d75580a1343f8e32cb83.dll,#12⤵PID:1748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 5483⤵
- Program crash
PID:1996
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1748 -ip 17481⤵PID:3468