Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 18:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8fdf814c9d25a25dfd9b51d8cf805f3b.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8fdf814c9d25a25dfd9b51d8cf805f3b.dll
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
8fdf814c9d25a25dfd9b51d8cf805f3b.dll
-
Size
128KB
-
MD5
8fdf814c9d25a25dfd9b51d8cf805f3b
-
SHA1
da8603742eb94b7654c73bb54bbf7cb758aee0e3
-
SHA256
fd73b4adb9d29bed9b8c93b64c674f303596c811caf12cf8d63dd31a5448622a
-
SHA512
7c8f8d39e062a66e6a39f318560ffa67548db1fdf7f9a96503af21366ea86eeb51c9dea5a46666e8762c1811db8e157ed146632977c0516d22a2ef32d5afd397
-
SSDEEP
1536:dgvFMUT+u0W+9NfY9bjGbhTIkTd0JsZsUdYApm90cVe2wPb5JQ1KyyqBdDXpj4CT:d6LTZ9+nKS8cKYw0OwdcBBdD+CH+m
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1184 4524 WerFault.exe 15 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4176 wrote to memory of 4524 4176 rundll32.exe 15 PID 4176 wrote to memory of 4524 4176 rundll32.exe 15 PID 4176 wrote to memory of 4524 4176 rundll32.exe 15
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8fdf814c9d25a25dfd9b51d8cf805f3b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8fdf814c9d25a25dfd9b51d8cf805f3b.dll,#12⤵PID:4524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 6163⤵
- Program crash
PID:1184
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4524 -ip 45241⤵PID:1376