Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll
Resource
win10v2004-20220812-en
General
-
Target
a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll
-
Size
144KB
-
MD5
37f12f5203e1008e254c33ed5c697da5
-
SHA1
4482eef11be48eba1ecd169b04beaa3697f167dc
-
SHA256
a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb
-
SHA512
b0fd9b11f5414e5dddbe195494e40cee96ab47241624a35700f8254da994a43015862c44817453dbc1a44e4122b57497e94def365f6941a1a77160e0b2377d91
-
SSDEEP
3072:ndUP4vpdFCd6w+JaO1bP7O+Qc3q3FmqacLSSeKRAJEolPzTQZ51LEN1E8QorKgo:nmtWXG1mqacLSSx0zTQZ4jEPQ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1896 1080 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1080 2016 rundll32.exe 26 PID 2016 wrote to memory of 1080 2016 rundll32.exe 26 PID 2016 wrote to memory of 1080 2016 rundll32.exe 26 PID 2016 wrote to memory of 1080 2016 rundll32.exe 26 PID 2016 wrote to memory of 1080 2016 rundll32.exe 26 PID 2016 wrote to memory of 1080 2016 rundll32.exe 26 PID 2016 wrote to memory of 1080 2016 rundll32.exe 26 PID 1080 wrote to memory of 1896 1080 rundll32.exe 27 PID 1080 wrote to memory of 1896 1080 rundll32.exe 27 PID 1080 wrote to memory of 1896 1080 rundll32.exe 27 PID 1080 wrote to memory of 1896 1080 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 2403⤵
- Program crash
PID:1896
-
-