Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2023, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03.dll
Resource
win10v2004-20231020-en
General
-
Target
49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03.dll
-
Size
2.2MB
-
MD5
990201ee8e5ed8cbba7b6b96282ea82d
-
SHA1
179ae168dea30992998f325ea6fda5871058e27f
-
SHA256
49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03
-
SHA512
09f334a3253e6ee26a6c972e936c4fdb0be6fc4ca590137bbd7340cf3efb89c7a7539f3f136033daf513c0a8b75d92f706ee13981dd28ee210d75fe06d81fba0
-
SSDEEP
49152:TId0OM5Fym/8RgJfYM97tQjFozL19wNa/Wgi0:sCOM56yJOjFKp9JWg1
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2628 3376 WerFault.exe 88 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4524 wrote to memory of 3376 4524 rundll32.exe 88 PID 4524 wrote to memory of 3376 4524 rundll32.exe 88 PID 4524 wrote to memory of 3376 4524 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03.dll,#12⤵PID:3376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 5643⤵
- Program crash
PID:2628
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3376 -ip 33761⤵PID:2972