Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 13:41
Static task
static1
Behavioral task
behavioral1
Sample
01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll
Resource
win10v2004-20220901-en
General
-
Target
01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll
-
Size
44KB
-
MD5
d72d81dd50325da54b9b79c95be8a1f9
-
SHA1
411fb245b43263cebf52a6aab8027fc3b77805fc
-
SHA256
01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403
-
SHA512
c135a8bc62b5d599e37847599e04bd2f507852c197be95c1c01161fd14c65ff67ca27cb3246c0e2ae217c3e3bd06f2152d0f8cadead60b4b2ad0b05f4f4098cb
-
SSDEEP
768:M9rDLswTpBaoELyVLrLNhdgjrYDh3Fhg/V:M9owTpBaoELSLegDpFe/
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1180 1016 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 528 wrote to memory of 1016 528 rundll32.exe 81 PID 528 wrote to memory of 1016 528 rundll32.exe 81 PID 528 wrote to memory of 1016 528 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll,#12⤵PID:1016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 6003⤵
- Program crash
PID:1180
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1016 -ip 10161⤵PID:2704