Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll
Resource
win10v2004-20220812-en
General
-
Target
cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll
-
Size
920KB
-
MD5
97973a2895585289a9b8016ec2da7a80
-
SHA1
a7b92f277e2191dd87feb32ff070eed590b073c9
-
SHA256
cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104
-
SHA512
51b9dfb7c856e3dc332ef96478a02e68f7d214d9222516a8673c5365271ee0315794bbdbde34611dbfbcf3fc6138c488cda52ec8f523d8e8d60d9d1dd835e097
-
SSDEEP
12288:DFN2OEmVTCCrfei0ENkX5v4XpaO6AeAcAR2TT+yn:DFN2ODVWCbaE8QXEO6AeATR2vTn
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3056 4800 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4800 4840 rundll32.exe 79 PID 4840 wrote to memory of 4800 4840 rundll32.exe 79 PID 4840 wrote to memory of 4800 4840 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll,#12⤵PID:4800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 6203⤵
- Program crash
PID:3056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4800 -ip 48001⤵PID:440