Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 13:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3db86ff8ec6a30e07ad7830d8663ef7.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3db86ff8ec6a30e07ad7830d8663ef7.dll
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
a3db86ff8ec6a30e07ad7830d8663ef7.dll
-
Size
1005KB
-
MD5
a3db86ff8ec6a30e07ad7830d8663ef7
-
SHA1
41b669a530f9cb2a3a140bc6037f3292ef066b9e
-
SHA256
c40dd0364e3b327849c68139e072db09b5f71ab38a8526865c47766a61f2364f
-
SHA512
53f1bee877ca947458cd547c69ee73351e25e5a9dd86a0e45a765025f59d1eb221dd5f3f24fe20bd11dc9d179f50df5c3d319c090fc2b990b8fa15f48e2e5807
-
SSDEEP
3072:TQuZG/ZMiE61ouqY7dtACZrzNp/c3Wh4CyPuf5Vlxl+ROXReazAOF/uIAPX2hjik:EESt3rg3s4CyPuffLvseT/uZ4ji8CA5
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1952 2280 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2280 2732 rundll32.exe 85 PID 2732 wrote to memory of 2280 2732 rundll32.exe 85 PID 2732 wrote to memory of 2280 2732 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3db86ff8ec6a30e07ad7830d8663ef7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3db86ff8ec6a30e07ad7830d8663ef7.dll,#12⤵PID:2280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 6243⤵
- Program crash
PID:1952
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2280 -ip 22801⤵PID:4332