Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
01/10/2023, 23:32
Static task
static1
Behavioral task
behavioral1
Sample
f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9.dll
Resource
win10v2004-20230915-en
General
-
Target
f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9.dll
-
Size
116KB
-
MD5
40c14ac88a6e8f037f64c615ea0db06d
-
SHA1
2807334e87cd54f6f2d216131a7d4e05ec107ad2
-
SHA256
f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9
-
SHA512
7b92e8fd75be77c048e9d8db5fad70bf378bcd06d3ba222176a932a086227cb55e4db8d5ac8043208d3dc96efe6376997f1662928260ca7473605e29cfdfde63
-
SSDEEP
3072:8511XjdOCqDBIFG7uh3oeZ0SULJbr6NbU:8WFBD3SU
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2420 2224 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2224 2220 rundll32.exe 28 PID 2220 wrote to memory of 2224 2220 rundll32.exe 28 PID 2220 wrote to memory of 2224 2220 rundll32.exe 28 PID 2220 wrote to memory of 2224 2220 rundll32.exe 28 PID 2220 wrote to memory of 2224 2220 rundll32.exe 28 PID 2220 wrote to memory of 2224 2220 rundll32.exe 28 PID 2220 wrote to memory of 2224 2220 rundll32.exe 28 PID 2224 wrote to memory of 2420 2224 rundll32.exe 29 PID 2224 wrote to memory of 2420 2224 rundll32.exe 29 PID 2224 wrote to memory of 2420 2224 rundll32.exe 29 PID 2224 wrote to memory of 2420 2224 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 2403⤵
- Program crash
PID:2420
-
-