Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 19:01
Static task
static1
Behavioral task
behavioral1
Sample
dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b.dll
Resource
win7-20220812-en
General
-
Target
dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b.dll
-
Size
228KB
-
MD5
821a30f218c9859df50ad9cedebe7c20
-
SHA1
c4cc3a351a90f84a8620c8b72996e5f53f4368cb
-
SHA256
dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b
-
SHA512
479dd141586f4ecc368cc7b8ba29d76b00fa5124ba3f5e517cc44910cd0bd3012209b2f57a4eae59094eb723b4046f0f84a56ab747bcd090d2371d4ea662c9e1
-
SSDEEP
3072:00NbrbkYHUyP9eECVWfpIhbWoVnW6IioARoKO7JurNeBTg4vRP86T9OB/nDN02Zg:nrkYHjIWeWcd7MRMnfn0e5BGCeR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1616 rundll32mgr.exe -
Loads dropped DLL 9 IoCs
pid Process 1400 rundll32.exe 1400 rundll32.exe 1496 WerFault.exe 1496 WerFault.exe 1496 WerFault.exe 1496 WerFault.exe 1496 WerFault.exe 1496 WerFault.exe 1496 WerFault.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 1220 1400 WerFault.exe 28 1496 1616 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1400 1948 rundll32.exe 28 PID 1948 wrote to memory of 1400 1948 rundll32.exe 28 PID 1948 wrote to memory of 1400 1948 rundll32.exe 28 PID 1948 wrote to memory of 1400 1948 rundll32.exe 28 PID 1948 wrote to memory of 1400 1948 rundll32.exe 28 PID 1948 wrote to memory of 1400 1948 rundll32.exe 28 PID 1948 wrote to memory of 1400 1948 rundll32.exe 28 PID 1400 wrote to memory of 1616 1400 rundll32.exe 29 PID 1400 wrote to memory of 1616 1400 rundll32.exe 29 PID 1400 wrote to memory of 1616 1400 rundll32.exe 29 PID 1400 wrote to memory of 1616 1400 rundll32.exe 29 PID 1400 wrote to memory of 1220 1400 rundll32.exe 30 PID 1400 wrote to memory of 1220 1400 rundll32.exe 30 PID 1400 wrote to memory of 1220 1400 rundll32.exe 30 PID 1400 wrote to memory of 1220 1400 rundll32.exe 30 PID 1616 wrote to memory of 1496 1616 rundll32mgr.exe 31 PID 1616 wrote to memory of 1496 1616 rundll32mgr.exe 31 PID 1616 wrote to memory of 1496 1616 rundll32mgr.exe 31 PID 1616 wrote to memory of 1496 1616 rundll32mgr.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 1004⤵
- Loads dropped DLL
- Program crash
PID:1496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 2243⤵
- Program crash
PID:1220
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156