Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 12:48
Static task
static1
Behavioral task
behavioral1
Sample
SSShim.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
SSShim.dll
-
Size
107KB
-
MD5
958e728ff126cc10d96c55ffcd4809ea
-
SHA1
4446bd7a91396a016c065a287cd36baccbb25932
-
SHA256
359fe598079b923431adb9f2f1492ff67711ac8204b9109b2b6ee20ee10a012d
-
SHA512
e26bbde3c60a01ae28877b68dafe28f60b95a9eef82dd525ab4e395ab669c0e7e40cc36ac512102c15333ac7e33792f9da657ce0da467da3f94103b30d84b115
-
SSDEEP
3072:LAuTswhopeZfOxm3nKWDv0QRqhXtB4Mhl2h:MAsko8BO2LDv0QRqhXtB4
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2148 1456 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4604 wrote to memory of 1456 4604 rundll32.exe 84 PID 4604 wrote to memory of 1456 4604 rundll32.exe 84 PID 4604 wrote to memory of 1456 4604 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SSShim.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SSShim.dll,#12⤵PID:1456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 6003⤵
- Program crash
PID:2148
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1456 -ip 14561⤵PID:1692