Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 19:01

General

  • Target

    dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b.dll

  • Size

    228KB

  • MD5

    821a30f218c9859df50ad9cedebe7c20

  • SHA1

    c4cc3a351a90f84a8620c8b72996e5f53f4368cb

  • SHA256

    dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b

  • SHA512

    479dd141586f4ecc368cc7b8ba29d76b00fa5124ba3f5e517cc44910cd0bd3012209b2f57a4eae59094eb723b4046f0f84a56ab747bcd090d2371d4ea662c9e1

  • SSDEEP

    3072:00NbrbkYHUyP9eECVWfpIhbWoVnW6IioARoKO7JurNeBTg4vRP86T9OB/nDN02Zg:nrkYHjIWeWcd7MRMnfn0e5BGCeR

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 100
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 224
        3⤵
        • Program crash
        PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\rundll32mgr.exe

    Filesize

    60KB

    MD5

    94f2f6ffbba8e7644668b51b39983916

    SHA1

    63357bbdf90101969117983dbc0d4ed0e713c4d7

    SHA256

    ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

    SHA512

    d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    60KB

    MD5

    94f2f6ffbba8e7644668b51b39983916

    SHA1

    63357bbdf90101969117983dbc0d4ed0e713c4d7

    SHA256

    ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

    SHA512

    d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    60KB

    MD5

    94f2f6ffbba8e7644668b51b39983916

    SHA1

    63357bbdf90101969117983dbc0d4ed0e713c4d7

    SHA256

    ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

    SHA512

    d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    60KB

    MD5

    94f2f6ffbba8e7644668b51b39983916

    SHA1

    63357bbdf90101969117983dbc0d4ed0e713c4d7

    SHA256

    ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

    SHA512

    d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    60KB

    MD5

    94f2f6ffbba8e7644668b51b39983916

    SHA1

    63357bbdf90101969117983dbc0d4ed0e713c4d7

    SHA256

    ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

    SHA512

    d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    60KB

    MD5

    94f2f6ffbba8e7644668b51b39983916

    SHA1

    63357bbdf90101969117983dbc0d4ed0e713c4d7

    SHA256

    ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

    SHA512

    d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    60KB

    MD5

    94f2f6ffbba8e7644668b51b39983916

    SHA1

    63357bbdf90101969117983dbc0d4ed0e713c4d7

    SHA256

    ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

    SHA512

    d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    60KB

    MD5

    94f2f6ffbba8e7644668b51b39983916

    SHA1

    63357bbdf90101969117983dbc0d4ed0e713c4d7

    SHA256

    ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

    SHA512

    d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    60KB

    MD5

    94f2f6ffbba8e7644668b51b39983916

    SHA1

    63357bbdf90101969117983dbc0d4ed0e713c4d7

    SHA256

    ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

    SHA512

    d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    60KB

    MD5

    94f2f6ffbba8e7644668b51b39983916

    SHA1

    63357bbdf90101969117983dbc0d4ed0e713c4d7

    SHA256

    ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

    SHA512

    d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

  • memory/1400-61-0x0000000074830000-0x000000007486E000-memory.dmp

    Filesize

    248KB

  • memory/1400-60-0x0000000074870000-0x00000000748AE000-memory.dmp

    Filesize

    248KB

  • memory/1400-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

    Filesize

    8KB

  • memory/1400-71-0x0000000074830000-0x000000007486E000-memory.dmp

    Filesize

    248KB