Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll
Resource
win10v2004-20220812-en
General
-
Target
0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll
-
Size
422KB
-
MD5
0ea3292d91c3ff540ee07e5605204e60
-
SHA1
b6c36ae4c3bf39936501cedf0ee510508ac3b531
-
SHA256
0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9
-
SHA512
e1b6ee7fdcc5aef39580de4aa403810e5ea403332d657142c2d3a7436c08efb073f55073c0b31408c0898dbb35798b492d38c72691bfae2a9d042bdf71858d6c
-
SSDEEP
12288:j79qXvjRc5AoIY+NPUlWnVaKy3olgtErA:VqXvjRc5AoITcknAKm8g2k
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3768 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2964 3768 WerFault.exe 80 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1496 wrote to memory of 5072 1496 rundll32.exe 79 PID 1496 wrote to memory of 5072 1496 rundll32.exe 79 PID 1496 wrote to memory of 5072 1496 rundll32.exe 79 PID 5072 wrote to memory of 3768 5072 rundll32.exe 80 PID 5072 wrote to memory of 3768 5072 rundll32.exe 80 PID 5072 wrote to memory of 3768 5072 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
PID:3768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 2724⤵
- Program crash
PID:2964
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3768 -ip 37681⤵PID:1532
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD558da7ff3c598b41bbe4cb76d5666aaa8
SHA1e0b965f7a4e4bbeede3d1d4a82beab1209b2f2f6
SHA256885c8e15532b46d2203b50c67f593288968be6d5f7c79e19b637e0129a1f5987
SHA512c05ead242fe60c4aea4a034748edc2329cc31ebcad7b9895d1d0cc8a01e2891d40cfd2adda733780c5ecec0abbad71d5a30e55659752ee7199dadc3332cf027b
-
Filesize
87KB
MD558da7ff3c598b41bbe4cb76d5666aaa8
SHA1e0b965f7a4e4bbeede3d1d4a82beab1209b2f2f6
SHA256885c8e15532b46d2203b50c67f593288968be6d5f7c79e19b637e0129a1f5987
SHA512c05ead242fe60c4aea4a034748edc2329cc31ebcad7b9895d1d0cc8a01e2891d40cfd2adda733780c5ecec0abbad71d5a30e55659752ee7199dadc3332cf027b