Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 21:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
72e9b87c20a59904d7720ae19598f655.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
72e9b87c20a59904d7720ae19598f655.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
72e9b87c20a59904d7720ae19598f655.dll
-
Size
36KB
-
MD5
72e9b87c20a59904d7720ae19598f655
-
SHA1
817c8347d3d72dafb8626b9ec0ce925c81319138
-
SHA256
e2e4db7e47b4f1d6e8cf3ba702faf54090dd539e394cedbbf2c8891eda9235a9
-
SHA512
890d3508ed0f1061d70f609200c58f30bb586d916752a3fe1b876ac0e8201cbe7d39b8c6cd28d8c31a71da959f3ae2d8de6c5d64d4e3168e03344d0a7461c0be
-
SSDEEP
768:efZvslndrGz7WiOrDubDLvfVbgEqHNXGc:efZslWFqubffVCNv
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4300 1348 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3792 wrote to memory of 1348 3792 rundll32.exe 87 PID 3792 wrote to memory of 1348 3792 rundll32.exe 87 PID 3792 wrote to memory of 1348 3792 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72e9b87c20a59904d7720ae19598f655.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72e9b87c20a59904d7720ae19598f655.dll,#12⤵PID:1348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 6123⤵
- Program crash
PID:4300
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1348 -ip 13481⤵PID:1316