Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
d22a89c5a7013815f32dd0b14d2af2bbf39c75776611476197a201586c0184b1.dll
Resource
win7-20220812-en
General
-
Target
d22a89c5a7013815f32dd0b14d2af2bbf39c75776611476197a201586c0184b1.dll
-
Size
148KB
-
MD5
5e4d5b45b83a9ab9e9f5cd08795ea46f
-
SHA1
a57a953861e5af5892e151e34c8091cfc94354bc
-
SHA256
d22a89c5a7013815f32dd0b14d2af2bbf39c75776611476197a201586c0184b1
-
SHA512
cb4de9fc72db04766c64b5c4428c2d87c0ff1c5c380682140c40d7f2877eb291cd14a7c8ba016b226557d7d6c25669395e76e34d7235a3681381a9530766e3e7
-
SSDEEP
3072:235TQRLOyPfmwGpEyL1jPtxqgP2QA+ctjHMdkFR:yKN3mwgLZtEgP2QZcxMu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1456 rundll32mgr.exe -
resource yara_rule behavioral2/memory/1456-141-0x0000000000400000-0x000000000042C1D8-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1456 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1812 1456 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2280 2808 rundll32.exe 83 PID 2808 wrote to memory of 2280 2808 rundll32.exe 83 PID 2808 wrote to memory of 2280 2808 rundll32.exe 83 PID 2280 wrote to memory of 1456 2280 rundll32.exe 84 PID 2280 wrote to memory of 1456 2280 rundll32.exe 84 PID 2280 wrote to memory of 1456 2280 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d22a89c5a7013815f32dd0b14d2af2bbf39c75776611476197a201586c0184b1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d22a89c5a7013815f32dd0b14d2af2bbf39c75776611476197a201586c0184b1.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 101684⤵
- Program crash
PID:1812
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1456 -ip 14561⤵PID:1096
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
97KB
MD5ef5dc2521333fb418bd5518f1db3fd08
SHA13d5e8d6dbf09a599f674fe9d6c1d736b0c31cb70
SHA25675bfc7c1f54f2579541c35f721a6bbd9083c7208bd989624ceb25f16bd03afbe
SHA5128768e95f5539dc61350f552d575c683e20e000f41283701c9c5f393da40975a02a7d432374c72565f3e1848266ee94e20d905f62b849f91f3c956b7980d87882
-
Filesize
97KB
MD5ef5dc2521333fb418bd5518f1db3fd08
SHA13d5e8d6dbf09a599f674fe9d6c1d736b0c31cb70
SHA25675bfc7c1f54f2579541c35f721a6bbd9083c7208bd989624ceb25f16bd03afbe
SHA5128768e95f5539dc61350f552d575c683e20e000f41283701c9c5f393da40975a02a7d432374c72565f3e1848266ee94e20d905f62b849f91f3c956b7980d87882