Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 18:38
Static task
static1
Behavioral task
behavioral1
Sample
07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll
Resource
win10v2004-20240704-en
General
-
Target
07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll
-
Size
20KB
-
MD5
d1ce027186875abb6276c3c728ebc608
-
SHA1
a4ec7cf604b466079395c8a4b80bfcc7274f18a1
-
SHA256
07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2
-
SHA512
418458c102cf3be56c0fb46c2899b52c60922974bccec8d22113ebde3b747ab143e20d4a9dc494184f623803009f7c6f14f7e1907fea14a0de65928d9796d9f5
-
SSDEEP
96:X908s82LTQTLnOU19Fi6kITearYEoosuvV/O:t08n2fQ/P1QIqajoosk
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1676 2060 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3576 wrote to memory of 2060 3576 rundll32.exe 82 PID 3576 wrote to memory of 2060 3576 rundll32.exe 82 PID 3576 wrote to memory of 2060 3576 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll,#12⤵PID:2060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 6003⤵
- Program crash
PID:1676
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2060 -ip 20601⤵PID:5080