Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 22:56
Static task
static1
Behavioral task
behavioral1
Sample
NaTfRzldqphjNX.bat
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
NaTfRzldqphjNX.bat
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
kcftZUmITYgNCj.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
kcftZUmITYgNCj.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
project details.lnk
Resource
win7-20220812-en
General
-
Target
kcftZUmITYgNCj.dll
-
Size
3.6MB
-
MD5
59e784a067345a37edb515c36f561c19
-
SHA1
102d63cb15a2b2a09408f6c9f216fb897b80d625
-
SHA256
501bd028925f20d7ebaca6b0ef50a90f0716579920df0b7aa2a44da862a06c68
-
SHA512
9b8778e40d100cbb76248b410eebe5fce9b07faee0d87f49c481ef70774be8a7a69847378f8f90a1ca0a5efaaef8cba9a1bdd96ca415f1276b22b8beef797faa
-
SSDEEP
49152:4DKZOp4/wXojetiGde8wzcVZWKOhGV1WqRqiW:UKZOp4/wttjE8NZWKOhGV1WqRqiW
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2556 3628 WerFault.exe 52
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\kcftZUmITYgNCj.dll,#11⤵PID:3628
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3628 -s 3362⤵
- Program crash
PID:2556
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 3628 -ip 36281⤵PID:3372