Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20/03/2024, 02:34
Behavioral task
behavioral1
Sample
d7aaa8d9e7065cd07643f456e398120b.dll
Resource
win7-20240215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
d7aaa8d9e7065cd07643f456e398120b.dll
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
d7aaa8d9e7065cd07643f456e398120b.dll
-
Size
18KB
-
MD5
d7aaa8d9e7065cd07643f456e398120b
-
SHA1
65cab3ab159cc39dc648b7052425ecb7c8e4e0c5
-
SHA256
b43f22d335794c07fce649262961dcb166837cd860cc934c90504346c0817390
-
SHA512
bc90e9074d5a99d12a5f0c004eaaa6bdc2c277d615457bf1022ef70e3c42b2a24eb4e05fb36dc7d9fe6db5501e97df6a4471f48bf23e8ef5efd2f2becb843621
-
SSDEEP
384:wxDDixReG0xWi7n6zFgKzND07xDf5jFUdnyHaI80Tsvt2X:++Rpyb6zWKzND6SdyHVnTY4X
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4416-0-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral2/memory/4416-1-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral2/memory/4416-2-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral2/memory/4416-3-0x0000000010000000-0x0000000010011000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1492 4416 WerFault.exe 88 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4416 rundll32.exe 4416 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 752 wrote to memory of 4416 752 rundll32.exe 88 PID 752 wrote to memory of 4416 752 rundll32.exe 88 PID 752 wrote to memory of 4416 752 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7aaa8d9e7065cd07643f456e398120b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7aaa8d9e7065cd07643f456e398120b.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:4416 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 5923⤵
- Program crash
PID:1492
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4416 -ip 44161⤵PID:2700