Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
177s -
max time network
218s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 13:37
Static task
static1
Behavioral task
behavioral1
Sample
9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll
Resource
win10v2004-20220812-en
General
-
Target
9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll
-
Size
65KB
-
MD5
6b2bd82bca12c3a61a7a1a991891d100
-
SHA1
4faee0d1fbcd4d6fec21d8433ac6a47668641820
-
SHA256
9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938
-
SHA512
d420e286b4a4ed0b37e2e13484fcefad731406bba21fbcdaae8642019d0805e5177fde6bb555d4a291a5a2a56b9c4fe0f98c0cf2091ad0ad805458d0659990ab
-
SSDEEP
768:4sQBTinxkpd9phmfB20RTviDxS2GBg9fMcuqmyI+UWxJha5:45BTScd9zNDADBgnuqmL5m
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1712 1436 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3340 wrote to memory of 1436 3340 rundll32.exe 81 PID 3340 wrote to memory of 1436 3340 rundll32.exe 81 PID 3340 wrote to memory of 1436 3340 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll,#12⤵PID:1436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 5563⤵
- Program crash
PID:1712
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1436 -ip 14361⤵PID:484