Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll
Resource
win10v2004-20221111-en
General
-
Target
af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll
-
Size
311KB
-
MD5
0dbf2e5fbcbc2a0f8128dac471ae1781
-
SHA1
18cc048f3dc7053f242b8c9cc4996ea7ca9b8ec1
-
SHA256
af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd
-
SHA512
7c26fe65cf712d72460d2c01c7e9bacfc23608646a516c9b0f7cff31e5f4bdc540ec5a44815e69c742f3f08fc179e68c2ef14138211a0f703f812e608b93b205
-
SSDEEP
6144:iqNG9C3ucRmzvXuQovJS0WEuE8c7eKfryJDvaLqi7LGjeOTB1VwAfAK:pNJucRmD5IJru67MaLqi76jeOT3h4K
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1780 1152 WerFault.exe 81 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe 1152 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1152 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4412 wrote to memory of 1152 4412 rundll32.exe 81 PID 4412 wrote to memory of 1152 4412 rundll32.exe 81 PID 4412 wrote to memory of 1152 4412 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 6843⤵
- Program crash
PID:1780
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1152 -ip 11521⤵PID:1804