Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 12:17
Static task
static1
Behavioral task
behavioral1
Sample
ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll
Resource
win10v2004-20220901-en
General
-
Target
ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll
-
Size
100KB
-
MD5
6e64b1199242a8eff3fa965ed48debc0
-
SHA1
3654d8c0df019c5d2239a1e318ef06ebc7bfcf8b
-
SHA256
ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b
-
SHA512
00fc9db62ec404f55a85bee124149a48d17c380dc4c0dfa9108a9d8c66014e2141c1007227c19cf954f7ae5c788947412c9301ffe3c76c64a8419e2c6bb069c1
-
SSDEEP
1536:0U/TEE5kmxI5QPS1rHCZO9XIx089oPnjNrxa1VQ4VuBk4hWaOH5YNak:bbEExxI5QqVV9ZPjxSGk44auYNb
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4060 4312 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2248 wrote to memory of 4312 2248 regsvr32.exe 83 PID 2248 wrote to memory of 4312 2248 regsvr32.exe 83 PID 2248 wrote to memory of 4312 2248 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll2⤵PID:4312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 6163⤵
- Program crash
PID:4060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4312 -ip 43121⤵PID:3556