Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 21:35

General

  • Target

    09160b694bfa0a3e19802d939c4905e6d4fcd68b87fafcfb0f1da881ac6c7687.dll

  • Size

    148KB

  • MD5

    0f7d100b93d684f36f2bac3bdca90eb0

  • SHA1

    f9a3512fccf26d264152c174324cfc978586115d

  • SHA256

    09160b694bfa0a3e19802d939c4905e6d4fcd68b87fafcfb0f1da881ac6c7687

  • SHA512

    9b72a639c9aa5a7096acd45ca553800a7d799bc868cc2820cbd8db501fc3fbb53d99a2caa82653762619badac9cd48019fcb626dbece484e95c3beb891886e5a

  • SSDEEP

    3072:Cx73qAAdzsF+Q194ZvLEbFLur5Iz7al3fB9DtcRBzR6Rq1:AqAAdzbZvLkFLuqal3fB9OR1R6Ry

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\09160b694bfa0a3e19802d939c4905e6d4fcd68b87fafcfb0f1da881ac6c7687.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\09160b694bfa0a3e19802d939c4905e6d4fcd68b87fafcfb0f1da881ac6c7687.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4520
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        PID:4244
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 264
          4⤵
          • Program crash
          PID:3816
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 608
        3⤵
        • Program crash
        PID:2108
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4244 -ip 4244
    1⤵
      PID:2900
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4520 -ip 4520
      1⤵
        PID:2316

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\rundll32mgr.exe

        Filesize

        105KB

        MD5

        27761550031391c56a3a59d3cb7229a5

        SHA1

        643e456a5fb02a820e79e33fc66e8496f15e5955

        SHA256

        b6b449ecd550692a3d8d5424e00885155e898d5cbbde98543a5b7b877073daab

        SHA512

        2aa9607f71e4cb99ab4ccabe33a5f192117b733306cd8d1f4f3054077572e522bc71e1eae679877b5554d0bc3c1281fd5bcf822a2da5da291e6630f65470d0d6

      • C:\Windows\SysWOW64\rundll32mgr.exe

        Filesize

        105KB

        MD5

        27761550031391c56a3a59d3cb7229a5

        SHA1

        643e456a5fb02a820e79e33fc66e8496f15e5955

        SHA256

        b6b449ecd550692a3d8d5424e00885155e898d5cbbde98543a5b7b877073daab

        SHA512

        2aa9607f71e4cb99ab4ccabe33a5f192117b733306cd8d1f4f3054077572e522bc71e1eae679877b5554d0bc3c1281fd5bcf822a2da5da291e6630f65470d0d6

      • memory/4244-137-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/4520-136-0x000000006D1C0000-0x000000006D1E5000-memory.dmp

        Filesize

        148KB