Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
daa954eb4d5f58cdb16b81ca506bf17431d516183d7c96b0a729f21bd4a7db1d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
daa954eb4d5f58cdb16b81ca506bf17431d516183d7c96b0a729f21bd4a7db1d.dll
Resource
win10v2004-20220812-en
General
-
Target
daa954eb4d5f58cdb16b81ca506bf17431d516183d7c96b0a729f21bd4a7db1d.dll
-
Size
210KB
-
MD5
835d8def4c042ae7de4c3521b0fe538e
-
SHA1
aa55f51af52417c6b45fafb534337b72e1fed42b
-
SHA256
daa954eb4d5f58cdb16b81ca506bf17431d516183d7c96b0a729f21bd4a7db1d
-
SHA512
44da60efb79b4ea804e1f4b5322aff8d596919d9f3c26b13320d3f456d187fe7529d685316d993a0e95dd409180e3508ef22e0f564b8c4520e4ee595b144b7d6
-
SSDEEP
6144:yuhyOCp5rwhfZLH5L5AwVoAsUM76X1zCYY:yuYf5rGfdbJVo4M0l
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1724 748 WerFault.exe 19 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 536 wrote to memory of 748 536 regsvr32.exe 19 PID 536 wrote to memory of 748 536 regsvr32.exe 19 PID 536 wrote to memory of 748 536 regsvr32.exe 19 PID 536 wrote to memory of 748 536 regsvr32.exe 19 PID 536 wrote to memory of 748 536 regsvr32.exe 19 PID 536 wrote to memory of 748 536 regsvr32.exe 19 PID 536 wrote to memory of 748 536 regsvr32.exe 19 PID 748 wrote to memory of 1724 748 regsvr32.exe 27 PID 748 wrote to memory of 1724 748 regsvr32.exe 27 PID 748 wrote to memory of 1724 748 regsvr32.exe 27 PID 748 wrote to memory of 1724 748 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\daa954eb4d5f58cdb16b81ca506bf17431d516183d7c96b0a729f21bd4a7db1d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\daa954eb4d5f58cdb16b81ca506bf17431d516183d7c96b0a729f21bd4a7db1d.dll2⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 3043⤵
- Program crash
PID:1724
-
-