Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 15:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
80346d2b59f81f05f11dfcb6caeb5723.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
80346d2b59f81f05f11dfcb6caeb5723.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
80346d2b59f81f05f11dfcb6caeb5723.dll
-
Size
72KB
-
MD5
80346d2b59f81f05f11dfcb6caeb5723
-
SHA1
67ec411b452f4877140e39d8e4d4d303c8416354
-
SHA256
638b0e2ffbfeabfd48e26c8db43e9b7eb1c65cf02a39608f6132f80b12388abd
-
SHA512
9c1713eedcf45702e6e4b08c061029ffb2470a3739f9a406b0915e7c16a400731650a266c47ef30cee67131d11e1c1adbaf11c9d8f9671e4e088a2351bc8c7c5
-
SSDEEP
1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3512 3760 WerFault.exe 73 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1548 wrote to memory of 3760 1548 rundll32.exe 73 PID 1548 wrote to memory of 3760 1548 rundll32.exe 73 PID 1548 wrote to memory of 3760 1548 rundll32.exe 73
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\80346d2b59f81f05f11dfcb6caeb5723.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\80346d2b59f81f05f11dfcb6caeb5723.dll,#12⤵PID:3760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 6003⤵
- Program crash
PID:3512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3760 -ip 37601⤵PID:1424