Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
c556cb974ccb6b9ffa4d9f308dec8382c2555f36ffe9e21d53eabd88e39d03fd.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c556cb974ccb6b9ffa4d9f308dec8382c2555f36ffe9e21d53eabd88e39d03fd.dll
Resource
win10v2004-20220812-en
General
-
Target
c556cb974ccb6b9ffa4d9f308dec8382c2555f36ffe9e21d53eabd88e39d03fd.dll
-
Size
141KB
-
MD5
467f7879f3399451d38ef84b4a67a28c
-
SHA1
36cf46fdf5111ea191edbdc91fc3f83f15031c36
-
SHA256
c556cb974ccb6b9ffa4d9f308dec8382c2555f36ffe9e21d53eabd88e39d03fd
-
SHA512
d4853bf76a522c373a81886476c9fb78ba328410358e15eddf9c1ba521e0da3014fd464470fcd425b1e2be44bb5002b81f95a01fc8eb79344c94b8058340190e
-
SSDEEP
3072:S1kMaSlYoyqHF6NQUqpkmcGDO6AqEnWWakfP4wDPd3/vD+QleKt2G:S1dnxriRG2qEWWahwDPd3/NlcG
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1372 4440 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4476 wrote to memory of 4440 4476 rundll32.exe 82 PID 4476 wrote to memory of 4440 4476 rundll32.exe 82 PID 4476 wrote to memory of 4440 4476 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c556cb974ccb6b9ffa4d9f308dec8382c2555f36ffe9e21d53eabd88e39d03fd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c556cb974ccb6b9ffa4d9f308dec8382c2555f36ffe9e21d53eabd88e39d03fd.dll,#12⤵PID:4440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 5723⤵
- Program crash
PID:1372
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4440 -ip 44401⤵PID:1500