Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
Resource
win10v2004-20220812-en
General
-
Target
e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
-
Size
120KB
-
MD5
629242bce7ed1b4514de65a45aa22ec2
-
SHA1
0ff110fac76aab7923aeaac8eb4991495678a8ff
-
SHA256
e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452
-
SHA512
4ea8bebe96ec43cb7691f6ccbf448b3415c7bbc9d2a4dbcdde7570351cda9a64a95d8339100972ee0c83d8389d8735c6b3297e15a10c4d8f0ad2f195f630d669
-
SSDEEP
1536:DoqWQ4AAp40cfnUkN2NxQVbtMXBXoyoOKNz78O:yxAN0mUdMMIP7n
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3940 2100 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 888 wrote to memory of 2100 888 regsvr32.exe 82 PID 888 wrote to memory of 2100 888 regsvr32.exe 82 PID 888 wrote to memory of 2100 888 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll1⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll2⤵PID:2100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 6363⤵
- Program crash
PID:3940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2100 -ip 21001⤵PID:5004