Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 17:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
683dd6fbc6c86b24863d2a54016fb94f.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
683dd6fbc6c86b24863d2a54016fb94f.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
683dd6fbc6c86b24863d2a54016fb94f.dll
-
Size
106KB
-
MD5
683dd6fbc6c86b24863d2a54016fb94f
-
SHA1
0f9c319a5c4c9c91310113af221a8777064d4fae
-
SHA256
96ccf04bd84f96359a2876d3204697ce5aa20dbb62365fa17d265511d6f7c9a6
-
SHA512
ddbebc08e879780811604d9a3b9df9664cda8ad6971a0faee50b9c81323449040089a7664737bee339a381ff2f152ec7420355984216316dd5c0ea4bf6496b4d
-
SSDEEP
3072:kajVVWR9a39WuNN26E0Rc8pusobWKQh+srJ1gkip6jby88:lVMHiN24Xuj5QQ8JmY8
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3416 2240 WerFault.exe 63 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2240 2132 rundll32.exe 63 PID 2132 wrote to memory of 2240 2132 rundll32.exe 63 PID 2132 wrote to memory of 2240 2132 rundll32.exe 63
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\683dd6fbc6c86b24863d2a54016fb94f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\683dd6fbc6c86b24863d2a54016fb94f.dll,#12⤵PID:2240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 5803⤵
- Program crash
PID:3416
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2240 -ip 22401⤵PID:2784