Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2024, 22:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
87c7fb94af0b3ccd6a224242ef61d04d.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
87c7fb94af0b3ccd6a224242ef61d04d.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
87c7fb94af0b3ccd6a224242ef61d04d.dll
-
Size
89KB
-
MD5
87c7fb94af0b3ccd6a224242ef61d04d
-
SHA1
03f70d52c10a98cd9c8b6d85c04ad335eadf4a7d
-
SHA256
3d65f1685167c36b0c54069e0ae1208a86db1fb29f5124af032565717bac2dad
-
SHA512
05631d31c2e5a842ad28be5166ce7f7bda00c5da8dcce560a7dc08eb1bcd217342ad2d3f0b52dce297431b586ca9dbdff79c7ae1d84728e68718ee46647d15a6
-
SSDEEP
1536:qf5iwvF7Tpqmq3ZA9R7YboD3hS1Uh0956GtoYk1ppVdl7PybhOfyI+boU:U5RvF7Tkmq3ZqR7Y0D3eUh666oYk15ze
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 544 3212 WerFault.exe 22 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3664 wrote to memory of 3212 3664 regsvr32.exe 22 PID 3664 wrote to memory of 3212 3664 regsvr32.exe 22 PID 3664 wrote to memory of 3212 3664 regsvr32.exe 22
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\87c7fb94af0b3ccd6a224242ef61d04d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\87c7fb94af0b3ccd6a224242ef61d04d.dll2⤵PID:3212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 5963⤵
- Program crash
PID:544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3212 -ip 32121⤵PID:5084