Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    200s
  • max time network
    210s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 10:16

General

  • Target

    fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll

  • Size

    52KB

  • MD5

    1aee6597c61112056e085fc06b3daa60

  • SHA1

    269fe4eb65ec9bd5cea26200fbf645ae7f68e666

  • SHA256

    fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437

  • SHA512

    6a53b128ac1353a260455a3505c7fd7f69a7d83c63dcfde9f103ac3e43b1f87c497c4ba660475a6477fb3d4c9a40e6cc9831f4521082a3110d62abc491c5044d

  • SSDEEP

    768:lyOYs0Ci3T9qLkIB+0yM1/CWdoYqTjGa4EhRtIQ9hd+HPWVunTEDHA7wjca:lZzi34LkkV/RdoF7ecUHP7ER

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:204
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 608
        3⤵
        • Program crash
        PID:3688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 608
        3⤵
        • Program crash
        PID:4064
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 204 -ip 204
    1⤵
      PID:3100

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads