Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9.dll
Resource
win10v2004-20220812-en
General
-
Target
c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9.dll
-
Size
42KB
-
MD5
0de4757e1a14461cf9b5f4a2f11e7d6b
-
SHA1
7b1ac3ed259fa530c6a6b311517e0fa31da5dad4
-
SHA256
c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9
-
SHA512
83a00ad111a7be4ba2df67ca849618a4caf948301146a95a21eda2e1560e6194ef35571f03701390e32356bfa668ab952807ceae80208193d1098985e562700b
-
SSDEEP
768:7iODp22Zb9q8U1ewb6x1U8UfbMGKSbPwh1WDqUVyqK+GSvWBu:7iI22Z+0wb6x1YchlU4HS8u
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1992 376 WerFault.exe 80 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1100 wrote to memory of 376 1100 rundll32.exe 80 PID 1100 wrote to memory of 376 1100 rundll32.exe 80 PID 1100 wrote to memory of 376 1100 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9.dll,#12⤵PID:376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 5923⤵
- Program crash
PID:1992
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 376 -ip 3761⤵PID:1324