Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 21:34

General

  • Target

    0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll

  • Size

    422KB

  • MD5

    0ea3292d91c3ff540ee07e5605204e60

  • SHA1

    b6c36ae4c3bf39936501cedf0ee510508ac3b531

  • SHA256

    0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9

  • SHA512

    e1b6ee7fdcc5aef39580de4aa403810e5ea403332d657142c2d3a7436c08efb073f55073c0b31408c0898dbb35798b492d38c72691bfae2a9d042bdf71858d6c

  • SSDEEP

    12288:j79qXvjRc5AoIY+NPUlWnVaKy3olgtErA:VqXvjRc5AoITcknAKm8g2k

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:5072
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        PID:3768
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 272
          4⤵
          • Program crash
          PID:2964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3768 -ip 3768
    1⤵
      PID:1532

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\rundll32mgr.exe

      Filesize

      87KB

      MD5

      58da7ff3c598b41bbe4cb76d5666aaa8

      SHA1

      e0b965f7a4e4bbeede3d1d4a82beab1209b2f2f6

      SHA256

      885c8e15532b46d2203b50c67f593288968be6d5f7c79e19b637e0129a1f5987

      SHA512

      c05ead242fe60c4aea4a034748edc2329cc31ebcad7b9895d1d0cc8a01e2891d40cfd2adda733780c5ecec0abbad71d5a30e55659752ee7199dadc3332cf027b

    • C:\Windows\SysWOW64\rundll32mgr.exe

      Filesize

      87KB

      MD5

      58da7ff3c598b41bbe4cb76d5666aaa8

      SHA1

      e0b965f7a4e4bbeede3d1d4a82beab1209b2f2f6

      SHA256

      885c8e15532b46d2203b50c67f593288968be6d5f7c79e19b637e0129a1f5987

      SHA512

      c05ead242fe60c4aea4a034748edc2329cc31ebcad7b9895d1d0cc8a01e2891d40cfd2adda733780c5ecec0abbad71d5a30e55659752ee7199dadc3332cf027b

    • memory/3768-136-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB