Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
11104cb4970494f5fc485a2839d97fe7.dll
Resource
win7-20231215-en
General
-
Target
11104cb4970494f5fc485a2839d97fe7.dll
-
Size
228KB
-
MD5
11104cb4970494f5fc485a2839d97fe7
-
SHA1
a5528a3fbe8eda0e527aa5e932481396ab4e6231
-
SHA256
39d1de6a1fb303175651fe8001f5aa358f26342d0c5a1f6a47fd929a01faca5c
-
SHA512
e9ef07ca5b4c653a35567521137dd06b1ed9a525e3c6dce6771c23dc15a80f2511e772f1b571cb4ce05329e637de73b263be90e60d4482df84b1f5618be2ff9d
-
SSDEEP
3072:wgKKuiX63bw5dNjDh8pWVgTlFIYnFFD6DOM2iU0BVRoO9:hKZp3KNjVGvFF+SM2inhoW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2892 rundll32mgr.exe -
Loads dropped DLL 9 IoCs
pid Process 2124 rundll32.exe 2124 rundll32.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2832 2892 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2124 2464 rundll32.exe 28 PID 2464 wrote to memory of 2124 2464 rundll32.exe 28 PID 2464 wrote to memory of 2124 2464 rundll32.exe 28 PID 2464 wrote to memory of 2124 2464 rundll32.exe 28 PID 2464 wrote to memory of 2124 2464 rundll32.exe 28 PID 2464 wrote to memory of 2124 2464 rundll32.exe 28 PID 2464 wrote to memory of 2124 2464 rundll32.exe 28 PID 2124 wrote to memory of 2892 2124 rundll32.exe 29 PID 2124 wrote to memory of 2892 2124 rundll32.exe 29 PID 2124 wrote to memory of 2892 2124 rundll32.exe 29 PID 2124 wrote to memory of 2892 2124 rundll32.exe 29 PID 2892 wrote to memory of 2832 2892 rundll32mgr.exe 30 PID 2892 wrote to memory of 2832 2892 rundll32mgr.exe 30 PID 2892 wrote to memory of 2832 2892 rundll32mgr.exe 30 PID 2892 wrote to memory of 2832 2892 rundll32mgr.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\11104cb4970494f5fc485a2839d97fe7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\11104cb4970494f5fc485a2839d97fe7.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 1004⤵
- Loads dropped DLL
- Program crash
PID:2832
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD58a04558595485ce4e50f94301ef76535
SHA16fbb5ead4c083e2257be8fbadc386bb4b1a874e9
SHA2566d4b385cb816f26f78500326392dd5795857697aebc1678da82463c70b02b36b
SHA51287dfa39743490a51090c81e38cc9393ee48a1b3b51bfe451f73b72db34a65ac9f08447cbbd9b5e05363474248eb961c5b579cc06bb2957101caf19860792cdd3