Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 12:49
Static task
static1
Behavioral task
behavioral1
Sample
3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll
Resource
win10v2004-20230703-en
General
-
Target
3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll
-
Size
5.5MB
-
MD5
b0f0f17339e445bb2b6fc8b2f95cfaff
-
SHA1
e8f6c33e61ef736b3ef0a7c5a1d546c5c5c5b80c
-
SHA256
3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed
-
SHA512
e0684c91d1929888d53596d6c69845540454b6056ecee464de1af94e81b7e5d1e38feef70c63acad89049a80ca1e63d2556dc49e769d18097232217c4329d8a0
-
SSDEEP
98304:JusYTWLexlJyFJ3gBACUQrd+JeoFr+C3rBTgtbY2KcNw8oVfIAlRk4KLNWeUFV7j:UsYXxlM7e/wlT0yGTlj
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4856 4692 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3032 wrote to memory of 4692 3032 rundll32.exe 82 PID 3032 wrote to memory of 4692 3032 rundll32.exe 82 PID 3032 wrote to memory of 4692 3032 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll,#12⤵PID:4692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 6523⤵
- Program crash
PID:4856
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4692 -ip 46921⤵PID:5064