Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2024, 17:05
Behavioral task
behavioral1
Sample
b2aa23d6b4adb8f8623cc51498ba5c5d.dll
Resource
win7-20240221-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
b2aa23d6b4adb8f8623cc51498ba5c5d.dll
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
-
Target
b2aa23d6b4adb8f8623cc51498ba5c5d.dll
-
Size
184KB
-
MD5
b2aa23d6b4adb8f8623cc51498ba5c5d
-
SHA1
93c9b95d401213f3d9197a3d8c6398da335b6c96
-
SHA256
a3a875372a18e1e91397e6c3e7f5e0ab3dba911c5908188eb9f4de48b40f0416
-
SHA512
630639faa98888d5cd268340a4219e199df2b7d95b9ce37f961ecfa62e6d080900f9680fec2bcb74f4652a686b173537e00b5089f144519c468e185274d911d9
-
SSDEEP
3072:QILqzszmqBPWnF3wTn/4zxHHA1qi9R2BtzwD6TCaBPQGHHfWB4ulpj4SqJOrcYHG:QLhqB4FgT/4zRg2rzqCFBPR/WBDj4OrF
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2108-0-0x0000000000400000-0x0000000000449000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1604 2108 WerFault.exe 90 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1468 wrote to memory of 2108 1468 rundll32.exe 90 PID 1468 wrote to memory of 2108 1468 rundll32.exe 90 PID 1468 wrote to memory of 2108 1468 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2aa23d6b4adb8f8623cc51498ba5c5d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2aa23d6b4adb8f8623cc51498ba5c5d.dll,#12⤵PID:2108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 5403⤵
- Program crash
PID:1604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2108 -ip 21081⤵PID:3880