Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 21:05
Behavioral task
behavioral1
Sample
0c81ed46389a7b035b331f181148292a47da2a573616fc24db54bbd86fb906f5.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0c81ed46389a7b035b331f181148292a47da2a573616fc24db54bbd86fb906f5.dll
Resource
win10v2004-20230703-en
General
-
Target
0c81ed46389a7b035b331f181148292a47da2a573616fc24db54bbd86fb906f5.dll
-
Size
10.1MB
-
MD5
6c8d5eb4129873b8f9c6c893a5406c0c
-
SHA1
aef29213cc2cfe8ecaf6ad6e2cca9c4fa9377a02
-
SHA256
0c81ed46389a7b035b331f181148292a47da2a573616fc24db54bbd86fb906f5
-
SHA512
22d57ececd60c9d1c30bd546fd3c501853cad43f928f39c038e87330da85fead082a585d746320e272c81c61e511310d36b52bb5a3935c2e5290952bc8838596
-
SSDEEP
196608:rPKASzIj2wG5q3aQc2nSBh7ViC2MwSwQRFuxvd+Y1PCnoKXEgIgJJjCeffPx:9QHwGw3au6ViCPxwy+lCoKXZ/jPx
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1640-133-0x0000000010000000-0x0000000010ABD000-memory.dmp upx behavioral2/memory/1640-147-0x0000000010000000-0x0000000010ABD000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2860 1640 WerFault.exe 82 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1640 rundll32.exe 1640 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4316 wrote to memory of 1640 4316 rundll32.exe 82 PID 4316 wrote to memory of 1640 4316 rundll32.exe 82 PID 4316 wrote to memory of 1640 4316 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c81ed46389a7b035b331f181148292a47da2a573616fc24db54bbd86fb906f5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c81ed46389a7b035b331f181148292a47da2a573616fc24db54bbd86fb906f5.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 6163⤵
- Program crash
PID:2860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1640 -ip 16401⤵PID:3236