Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2022, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll
Resource
win10v2004-20220812-en
General
-
Target
9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll
-
Size
178KB
-
MD5
772ed458fa8a90dc2e9ba4f265b50dc2
-
SHA1
dd474b60bb9c6db1d991356280d39e91e9ede9fa
-
SHA256
9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323
-
SHA512
f163b0c328605ed22e336e9ac2fb3a16cc80d1ca26a923fc9ec8e531ba3e081ef742e7eb60655fa96f6357b253601558f54b3244ed52919d5f9af524b030db27
-
SSDEEP
3072:a4Y4C2x9OenRhtFdBAXKasJZegPlP08aow8xHAbNRDkfMa96Pn8neR8DV:fxVx95PFJasZr/w2HAbNpGCn8eR8p
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4816 4932 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4932 3156 rundll32.exe 79 PID 3156 wrote to memory of 4932 3156 rundll32.exe 79 PID 3156 wrote to memory of 4932 3156 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll,#12⤵PID:4932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 6323⤵
- Program crash
PID:4816
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4932 -ip 49321⤵PID:4928