Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
7772e99c3746ef4b90e02aa1eaf500d6e9f4b79c1b722bc748267df879e34d3f.dll
Resource
win7-20220812-en
General
-
Target
7772e99c3746ef4b90e02aa1eaf500d6e9f4b79c1b722bc748267df879e34d3f.dll
-
Size
453KB
-
MD5
915212b329545e42dcbb4aae6458ef10
-
SHA1
0880ba34642d03d652371c0eaec7010feb3b1a2c
-
SHA256
7772e99c3746ef4b90e02aa1eaf500d6e9f4b79c1b722bc748267df879e34d3f
-
SHA512
6646789f92c0fa91ac5a52ce1cc2c4a67dd8e1abc78983cf6ac76a7330251737e5f6e598402f7f66726e6a0f5a907e2e6026fbfe282ef93efa3b1b16e34e3564
-
SSDEEP
12288:h6qIr+648pT2vo7/lK/3uY8aWKG4MY3gxU81C/yxRVoXdsgd8kJyo39koTJ2vpu4:hdIr+646u8R3FKyo36QJO6A5U9Hg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4768 rundll32mgr.exe -
resource yara_rule behavioral2/memory/4768-138-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 4768 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4632 4768 WerFault.exe 80 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3376 wrote to memory of 2096 3376 rundll32.exe 79 PID 3376 wrote to memory of 2096 3376 rundll32.exe 79 PID 3376 wrote to memory of 2096 3376 rundll32.exe 79 PID 2096 wrote to memory of 4768 2096 rundll32.exe 80 PID 2096 wrote to memory of 4768 2096 rundll32.exe 80 PID 2096 wrote to memory of 4768 2096 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7772e99c3746ef4b90e02aa1eaf500d6e9f4b79c1b722bc748267df879e34d3f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7772e99c3746ef4b90e02aa1eaf500d6e9f4b79c1b722bc748267df879e34d3f.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 4764⤵
- Program crash
PID:4632
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4768 -ip 47681⤵PID:4704
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
106KB
MD5dcd2cafa72c9d5bd898b636a18133d3c
SHA1b55e85453de9254cbf4c21c0de92d82c6deefccb
SHA256936b14fbbf629fcf92ac06673d974de2b2a44a109953e6664e1c36a4e5c9d27c
SHA51259e475f668015b3a6372d79ea6459b21ae591d73305b7696ef139fe0e716f1038595ea5df079e1850535e6358aef4d8e92bdee68ffd07b44471bc7133041952c
-
Filesize
106KB
MD5dcd2cafa72c9d5bd898b636a18133d3c
SHA1b55e85453de9254cbf4c21c0de92d82c6deefccb
SHA256936b14fbbf629fcf92ac06673d974de2b2a44a109953e6664e1c36a4e5c9d27c
SHA51259e475f668015b3a6372d79ea6459b21ae591d73305b7696ef139fe0e716f1038595ea5df079e1850535e6358aef4d8e92bdee68ffd07b44471bc7133041952c