Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2023, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71.dll
Resource
win10v2004-20231020-en
General
-
Target
44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71.dll
-
Size
189KB
-
MD5
bb47f696fcecf06265d90a3c5747a8b2
-
SHA1
d154cf58a0f8ccdb309696c63fd8bf9740d55f8c
-
SHA256
44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71
-
SHA512
ef77527b2b0637f047fdbf15ad11ee82ab16721da45491a0988dce14985ac5b49f0a1b1dac2bb5558024b9f36145436795ccbcb5e0ea0f8be2ed5fb0f7f73162
-
SSDEEP
3072:FjB3UkpquSNj39ZwjqgeUl1MvZv79m/wKtGlKPgbY+CJyUKLXOLwbMPMZdpIH:tB3UkpquSNzLwxeWsZj9WuGTyUGOcbM/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4964 rundll32mgr.exe -
resource yara_rule behavioral2/files/0x00090000000224ad-3.dat upx behavioral2/files/0x00090000000224ad-4.dat upx behavioral2/memory/4964-5-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/4964-7-0x0000000000400000-0x000000000045B000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2296 4964 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3396 wrote to memory of 616 3396 rundll32.exe 88 PID 3396 wrote to memory of 616 3396 rundll32.exe 88 PID 3396 wrote to memory of 616 3396 rundll32.exe 88 PID 616 wrote to memory of 4964 616 rundll32.exe 89 PID 616 wrote to memory of 4964 616 rundll32.exe 89 PID 616 wrote to memory of 4964 616 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
PID:4964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 2644⤵
- Program crash
PID:2296
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4964 -ip 49641⤵PID:4376
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5dfb5daabb95dcfad1a5faf9ab1437076
SHA14a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA25654282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA5125d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8
-
Filesize
105KB
MD5dfb5daabb95dcfad1a5faf9ab1437076
SHA14a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA25654282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA5125d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8