Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22/04/2023, 23:15
Static task
static1
Behavioral task
behavioral1
Sample
d5010c158a2a8c537f87004657ff88605114ee09f973b6470d2c92603e60eb93.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
d5010c158a2a8c537f87004657ff88605114ee09f973b6470d2c92603e60eb93.dll
Resource
win10v2004-20230220-en
General
-
Target
d5010c158a2a8c537f87004657ff88605114ee09f973b6470d2c92603e60eb93.dll
-
Size
4.0MB
-
MD5
275f9bb9b9f1105ff823a8a0f5b5b75d
-
SHA1
b383bd19bac86a42c464f81528490eed39eb5343
-
SHA256
d5010c158a2a8c537f87004657ff88605114ee09f973b6470d2c92603e60eb93
-
SHA512
6e373c96544f78287732490d97c154d78fc6e96e1c5fc82220afaa990b79a66f6d28193ed8036403e9717c69f21b3061281bae6008f6685217c57b191fa3e944
-
SSDEEP
98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGz3:opLDM9RUYqBfO9nP5GIky+f9qLM
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1960 2012 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2012 2000 rundll32.exe 28 PID 2000 wrote to memory of 2012 2000 rundll32.exe 28 PID 2000 wrote to memory of 2012 2000 rundll32.exe 28 PID 2000 wrote to memory of 2012 2000 rundll32.exe 28 PID 2000 wrote to memory of 2012 2000 rundll32.exe 28 PID 2000 wrote to memory of 2012 2000 rundll32.exe 28 PID 2000 wrote to memory of 2012 2000 rundll32.exe 28 PID 2012 wrote to memory of 1960 2012 rundll32.exe 29 PID 2012 wrote to memory of 1960 2012 rundll32.exe 29 PID 2012 wrote to memory of 1960 2012 rundll32.exe 29 PID 2012 wrote to memory of 1960 2012 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5010c158a2a8c537f87004657ff88605114ee09f973b6470d2c92603e60eb93.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5010c158a2a8c537f87004657ff88605114ee09f973b6470d2c92603e60eb93.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 2483⤵
- Program crash
PID:1960
-
-