Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 09:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9912ddc093ee6dd935acbf90dd7a4686.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
9912ddc093ee6dd935acbf90dd7a4686.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
9912ddc093ee6dd935acbf90dd7a4686.dll
-
Size
29KB
-
MD5
9912ddc093ee6dd935acbf90dd7a4686
-
SHA1
aeee3fef88434fd41b2414f0e82151b0dccf3942
-
SHA256
c95d9eacf050a86b1e64ac3c3b46fa255c65bf564e5985ddcd1608b3cf241a15
-
SHA512
5571040a3a8da2c5af48e5179fb7d2c86ecc2c0bf371d724c154d03e12f2f67418532827af5ad988550e8721e5bc61bf60c0f233537248b7d47969145da5ace8
-
SSDEEP
384:yqk2QbTzIh6lyGXdyVpdOlYo1xvoLlqBR/4jedezGmMEAB0TpKgYEEUDNBUxERU:yqvhYyGXM0HXv8jhzBABAKgY6jDR
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1776 4968 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2872 wrote to memory of 4968 2872 rundll32.exe 84 PID 2872 wrote to memory of 4968 2872 rundll32.exe 84 PID 2872 wrote to memory of 4968 2872 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9912ddc093ee6dd935acbf90dd7a4686.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9912ddc093ee6dd935acbf90dd7a4686.dll,#12⤵PID:4968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 5443⤵
- Program crash
PID:1776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4968 -ip 49681⤵PID:4656