Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
a70f85f4671ff204120d25848c12c4953505b7da8826bc2d27cd6899ba664cc4.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a70f85f4671ff204120d25848c12c4953505b7da8826bc2d27cd6899ba664cc4.dll
Resource
win10v2004-20220812-en
General
-
Target
a70f85f4671ff204120d25848c12c4953505b7da8826bc2d27cd6899ba664cc4.dll
-
Size
210KB
-
MD5
0b86020dad7307c3eca7817b8cc0a3c0
-
SHA1
f4c901173d06d6620630f6931864cabad296c6cc
-
SHA256
a70f85f4671ff204120d25848c12c4953505b7da8826bc2d27cd6899ba664cc4
-
SHA512
89bf8e179e16ca3ca89caa58ef8476d7435d581d7ec6454bbb0d817fd3f1d7d2785681fd3431dfbfa4a80ce41a531fb1d3c2e94af9a2b7d9838c6e97aa6ef6ef
-
SSDEEP
6144:yuh9Xs1/Eqj5UovHkyJqJBl5VtJYluAOx/:yuDy/tGofjgVlbP
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 988 4988 WerFault.exe 82 2272 4988 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3040 wrote to memory of 4988 3040 regsvr32.exe 82 PID 3040 wrote to memory of 4988 3040 regsvr32.exe 82 PID 3040 wrote to memory of 4988 3040 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a70f85f4671ff204120d25848c12c4953505b7da8826bc2d27cd6899ba664cc4.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a70f85f4671ff204120d25848c12c4953505b7da8826bc2d27cd6899ba664cc4.dll2⤵PID:4988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 6083⤵
- Program crash
PID:988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 6523⤵
- Program crash
PID:2272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4988 -ip 49881⤵PID:4900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4988 -ip 49881⤵PID:2256