Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 12:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TSpkg.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
TSpkg.dll
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
TSpkg.dll
-
Size
76KB
-
MD5
9945f0c9c1944e3d6c49f74f67b6c0d0
-
SHA1
c017a0b9449c4b1292901c41a6312907fe0d8e6f
-
SHA256
f518e99b980ef40a6480e0bccdce3a1abc07e18be6db21fa987c297b32b8af08
-
SHA512
9dafd2480a30b03dfa4a1766d8aec45f8772c39f91e690fb57204946b621e9b7fa4a4daaeae19bd4594fa681939b41cbb12ca379af61dd5204ecd4a2205df959
-
SSDEEP
1536:GBqIofSInrKOS1tTvKVEDUJFXjUIiaoqNK0HGHTtOJvOMHUPT:YofRnrkvKqDUvXYYlNK0HGHTcwMHUP
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2912 5076 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4392 wrote to memory of 5076 4392 rundll32.exe 83 PID 4392 wrote to memory of 5076 4392 rundll32.exe 83 PID 4392 wrote to memory of 5076 4392 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TSpkg.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TSpkg.dll,#12⤵PID:5076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 6163⤵
- Program crash
PID:2912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5076 -ip 50761⤵PID:4544