Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll
Resource
win10v2004-20220812-en
General
-
Target
bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll
-
Size
112KB
-
MD5
5fe97e6ea9f6fbf6d5bc893b060e2529
-
SHA1
9da6fd61712a8b92d767ad0396cb19791e254c36
-
SHA256
bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca
-
SHA512
db341d804f3a1fa56e1d462db4632f6140c2fe22edf4c0d6fca18dad9bb516ccac5be8719da5dd5caccfb6be3b5357a58db3bfa0344ddf80cdb488b896bf9c3e
-
SSDEEP
3072:+gAG47YsyLGiB4Xu8Q5ddAPbbcSezwU861IO:+gA7YsyyZe4PcVwFc
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1892 4408 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4960 wrote to memory of 4408 4960 rundll32.exe 84 PID 4960 wrote to memory of 4408 4960 rundll32.exe 84 PID 4960 wrote to memory of 4408 4960 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll,#12⤵PID:4408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 6443⤵
- Program crash
PID:1892
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4408 -ip 44081⤵PID:5080