Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 18:13
Static task
static1
Behavioral task
behavioral1
Sample
c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll
Resource
win10v2004-20220812-en
General
-
Target
c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll
-
Size
102KB
-
MD5
3983fe5a3da123b2fdf237908044b200
-
SHA1
2302ebd1ac8a30e5265ba1c06af20e6c31b3357d
-
SHA256
c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76
-
SHA512
891b526115ddc4a83822f18a91b00d9e4bc8781609e88774e6e791b474524b43fb8d8b9d95a31ea504cb66f6ccb93087bd1cee66284a2cd27c4e704d80b70742
-
SSDEEP
3072:KfEltY+UGznKyqoL0Rhx378GAjtN/CdwFR76Uzgr2s7c:YCaPybWxL1+era
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 460 1404 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 800 wrote to memory of 1404 800 rundll32.exe 79 PID 800 wrote to memory of 1404 800 rundll32.exe 79 PID 800 wrote to memory of 1404 800 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll,#12⤵PID:1404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 5443⤵
- Program crash
PID:460
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1404 -ip 14041⤵PID:4304