Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d.dll
Resource
win10v2004-20220812-en
General
-
Target
88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d.dll
-
Size
150KB
-
MD5
f95ac93c1f2f1f6821ec427c9ebeef20
-
SHA1
495e9e01b470d38da29a9a4c5eb31cc6ae5fe1e4
-
SHA256
88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d
-
SHA512
f5b570362ff1f5e02ac348a647ae9d900a9f4efe68ce422f5f450de9b4f19d67b2e09e6f47dfe0ea6c819cdf43511607ef1bbfd3eeb55ea1909691317cb7d02e
-
SSDEEP
3072:suhE6zRk8Rj874WfvSRzR4D4HIOaDC9x5GKs2rsndZfx:suhnj8UKKRzRLHIOaDCX5GKF4Z
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1712 960 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1956 wrote to memory of 960 1956 rundll32.exe 28 PID 1956 wrote to memory of 960 1956 rundll32.exe 28 PID 1956 wrote to memory of 960 1956 rundll32.exe 28 PID 1956 wrote to memory of 960 1956 rundll32.exe 28 PID 1956 wrote to memory of 960 1956 rundll32.exe 28 PID 1956 wrote to memory of 960 1956 rundll32.exe 28 PID 1956 wrote to memory of 960 1956 rundll32.exe 28 PID 960 wrote to memory of 1712 960 rundll32.exe 29 PID 960 wrote to memory of 1712 960 rundll32.exe 29 PID 960 wrote to memory of 1712 960 rundll32.exe 29 PID 960 wrote to memory of 1712 960 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 2723⤵
- Program crash
PID:1712
-
-