Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
200s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll
Resource
win10v2004-20221111-en
General
-
Target
fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll
-
Size
52KB
-
MD5
1aee6597c61112056e085fc06b3daa60
-
SHA1
269fe4eb65ec9bd5cea26200fbf645ae7f68e666
-
SHA256
fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437
-
SHA512
6a53b128ac1353a260455a3505c7fd7f69a7d83c63dcfde9f103ac3e43b1f87c497c4ba660475a6477fb3d4c9a40e6cc9831f4521082a3110d62abc491c5044d
-
SSDEEP
768:lyOYs0Ci3T9qLkIB+0yM1/CWdoYqTjGa4EhRtIQ9hd+HPWVunTEDHA7wjca:lZzi34LkkV/RdoF7ecUHP7ER
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 3688 204 WerFault.exe 83 4064 204 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2312 wrote to memory of 204 2312 rundll32.exe 83 PID 2312 wrote to memory of 204 2312 rundll32.exe 83 PID 2312 wrote to memory of 204 2312 rundll32.exe 83 PID 204 wrote to memory of 3688 204 rundll32.exe 85 PID 204 wrote to memory of 3688 204 rundll32.exe 85 PID 204 wrote to memory of 3688 204 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 6083⤵
- Program crash
PID:3688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 6083⤵
- Program crash
PID:4064
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 204 -ip 2041⤵PID:3100