Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2024, 09:49
Static task
static1
Behavioral task
behavioral1
Sample
869565e1fb8bee765e07f055db07a6d0.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
869565e1fb8bee765e07f055db07a6d0.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
869565e1fb8bee765e07f055db07a6d0.dll
-
Size
30KB
-
MD5
869565e1fb8bee765e07f055db07a6d0
-
SHA1
1199a367cc992b61ab4f5e77704ad2c03a180b22
-
SHA256
4d1284bc467df93da1eb82c4980989c55750f9e9a6fc7d566c54d21af5e91932
-
SHA512
c4edbd5e11fd76cf4748d44e8add0b8edab8ef56e7fd595cfa32b7f7b49fd0f9c38ca6f6013fc545212a7c5bea429b29de26b31dbfbfc30212a19246c9089cf6
-
SSDEEP
768:5bTXyOj2YoCK2LJedXOYkh9SakQxoDecn4LXx:552YJIdXAh9hpxo1n49
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3708 4108 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 600 wrote to memory of 4108 600 rundll32.exe 84 PID 600 wrote to memory of 4108 600 rundll32.exe 84 PID 600 wrote to memory of 4108 600 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\869565e1fb8bee765e07f055db07a6d0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\869565e1fb8bee765e07f055db07a6d0.dll,#12⤵PID:4108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 6323⤵
- Program crash
PID:3708
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4108 -ip 41081⤵PID:1576