Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 23:13
Static task
static1
Behavioral task
behavioral1
Sample
2971a8051f52cafdec8054d22f856e64405f7cbac4814dbef3de2ac6fe3a2b1b.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2971a8051f52cafdec8054d22f856e64405f7cbac4814dbef3de2ac6fe3a2b1b.dll
Resource
win10v2004-20220812-en
General
-
Target
2971a8051f52cafdec8054d22f856e64405f7cbac4814dbef3de2ac6fe3a2b1b.dll
-
Size
296KB
-
MD5
8a1b289fc90c19ada32d4ece8af45404
-
SHA1
199721b44a02524aa13b7c65bd3c2506372d4cf7
-
SHA256
2971a8051f52cafdec8054d22f856e64405f7cbac4814dbef3de2ac6fe3a2b1b
-
SHA512
89fde210134e70edd74e39466e0bd171a3d8e67b4032d2b4dde6b7fc2bf53b3f61647725fe3179fdd2cc86a618cdd3374976bcfdabd4d1ba72214f05a5ee8e62
-
SSDEEP
6144:b/FmdtUm7H9WNG9VxviI4GT+z0YphDDvI3EtpOXg42ZwPGb91:5Atis9iIxTby6j2aOb91
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 904 1964 WerFault.exe 9 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1964 wrote to memory of 904 1964 rundll32.exe 28 PID 1964 wrote to memory of 904 1964 rundll32.exe 28 PID 1964 wrote to memory of 904 1964 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2971a8051f52cafdec8054d22f856e64405f7cbac4814dbef3de2ac6fe3a2b1b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1964 -s 922⤵
- Program crash
PID:904
-