Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
39d30a3480e8c2c7bd1afe2a1cdaffab5eb7dc8f41242bf614817ffabc04d635.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
39d30a3480e8c2c7bd1afe2a1cdaffab5eb7dc8f41242bf614817ffabc04d635.dll
Resource
win10v2004-20220812-en
General
-
Target
39d30a3480e8c2c7bd1afe2a1cdaffab5eb7dc8f41242bf614817ffabc04d635.dll
-
Size
9KB
-
MD5
a2af030b7753848fab62158d25db8670
-
SHA1
d02651748a36100bde00109570d8413dabc5097d
-
SHA256
39d30a3480e8c2c7bd1afe2a1cdaffab5eb7dc8f41242bf614817ffabc04d635
-
SHA512
a58d38f7547fdcdfa1965c902668769731cd1aabd34ff3dfb46b5aa03b7053541b0065c7a5016e79de22b9674b658c9d0b7bbe78ec6283641ac3ff9cbdc2f9d7
-
SSDEEP
192:UNo5kmXmEEnkITKoUBQIEtNvokhF5hDJtKfnv23qJthDNp0:61mWEHI2oT7Nh9Dqv6qJtN70
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4688 4880 WerFault.exe 55 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4880 4816 rundll32.exe 55 PID 4816 wrote to memory of 4880 4816 rundll32.exe 55 PID 4816 wrote to memory of 4880 4816 rundll32.exe 55
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39d30a3480e8c2c7bd1afe2a1cdaffab5eb7dc8f41242bf614817ffabc04d635.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39d30a3480e8c2c7bd1afe2a1cdaffab5eb7dc8f41242bf614817ffabc04d635.dll,#12⤵PID:4880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 6203⤵
- Program crash
PID:4688
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4880 -ip 48801⤵PID:4788