Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d.dll
Resource
win10v2004-20220812-en
General
-
Target
88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d.dll
-
Size
150KB
-
MD5
f95ac93c1f2f1f6821ec427c9ebeef20
-
SHA1
495e9e01b470d38da29a9a4c5eb31cc6ae5fe1e4
-
SHA256
88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d
-
SHA512
f5b570362ff1f5e02ac348a647ae9d900a9f4efe68ce422f5f450de9b4f19d67b2e09e6f47dfe0ea6c819cdf43511607ef1bbfd3eeb55ea1909691317cb7d02e
-
SSDEEP
3072:suhE6zRk8Rj874WfvSRzR4D4HIOaDC9x5GKs2rsndZfx:suhnj8UKKRzRLHIOaDCX5GKF4Z
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1552 4240 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1404 wrote to memory of 4240 1404 rundll32.exe 79 PID 1404 wrote to memory of 4240 1404 rundll32.exe 79 PID 1404 wrote to memory of 4240 1404 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88d02c6023b713ade68c716942704d772ed5c50f1218bd795f1c8ad6c6d0695d.dll,#12⤵PID:4240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 8203⤵
- Program crash
PID:1552
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4240 -ip 42401⤵PID:4952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4240 -ip 42401⤵PID:4344