Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 06:24
Behavioral task
behavioral1
Sample
cbfbcd21c66d3d4d748502e22658cb4c4e56cca915a37302ef59690d68a215a6.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cbfbcd21c66d3d4d748502e22658cb4c4e56cca915a37302ef59690d68a215a6.dll
Resource
win10v2004-20220901-en
General
-
Target
cbfbcd21c66d3d4d748502e22658cb4c4e56cca915a37302ef59690d68a215a6.dll
-
Size
98KB
-
MD5
cb0c939268262b2ce0b1d60189aed1ca
-
SHA1
2cdd6e74c3a8480e7a24edb3edfd3bf569a33d0e
-
SHA256
cbfbcd21c66d3d4d748502e22658cb4c4e56cca915a37302ef59690d68a215a6
-
SHA512
356132fe035a778bcd7a159e380ff44278e09ad5e322dcbba1e1b35dc2b5965e20219da1258ea61c8b7bfbd7ca95f9cdc29735a846971a859b0501a3186e7cb4
-
SSDEEP
3072:qPR+57kHJuX2tceg2Fv8PgSlmcQuwAz27uK:QS7kpucwYvQxlmoBz27uK
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4976-133-0x0000000010000000-0x000000001002C000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 4568 4976 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5060 wrote to memory of 4976 5060 rundll32.exe 81 PID 5060 wrote to memory of 4976 5060 rundll32.exe 81 PID 5060 wrote to memory of 4976 5060 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbfbcd21c66d3d4d748502e22658cb4c4e56cca915a37302ef59690d68a215a6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbfbcd21c66d3d4d748502e22658cb4c4e56cca915a37302ef59690d68a215a6.dll,#12⤵PID:4976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 5443⤵
- Program crash
PID:4568
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4976 -ip 49761⤵PID:4844