Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 09:27
Static task
static1
Behavioral task
behavioral1
Sample
a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll
Resource
win10v2004-20220812-en
General
-
Target
a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll
-
Size
92KB
-
MD5
65ba33dd403405711a436cbdb09340dd
-
SHA1
25a7d468c5cd70dfed6a0da8c4058e608d01c852
-
SHA256
a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361
-
SHA512
4a701084d1c220594812cfdfbe8bdccf6b3f92692f2c5299e43d6b04559f1465b41e6c609c247701378782c393d60dfd74d84c38c75d7c517277aa6e326c1bd5
-
SSDEEP
1536:+ID7mEVe+fsZr0ItmnKXH99P5ju7/a9Z9OFS:JD6+C0IkKTPFuDa9ZI4
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1004 4444 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1436 wrote to memory of 4444 1436 rundll32.exe 81 PID 1436 wrote to memory of 4444 1436 rundll32.exe 81 PID 1436 wrote to memory of 4444 1436 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll,#12⤵PID:4444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 6683⤵
- Program crash
PID:1004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4444 -ip 44441⤵PID:3304