Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 16:40
Static task
static1
Behavioral task
behavioral1
Sample
35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834.dll
Resource
win10v2004-20240221-en
General
-
Target
35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834.dll
-
Size
4.2MB
-
MD5
9c5fc32466ce3cbbf1fc28241bcace16
-
SHA1
e2862b204a63d61af3c6d3ded3dea6ca7ba47a63
-
SHA256
35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834
-
SHA512
637506e50abdd04795610b358a2cf72e0580eeb46706942e2ae2d1cfc442f098c589959edf483f2ef911c3ec996763f1ba4c595c23d4205fd5ed5f9e149e2e78
-
SSDEEP
49152:AGq1SZZLP9l968KSDXr+ktOHh9oJEv9PDsx2ndPwqFELm/XcCGfTETwmA93:tq1mKQwHh9PPDsxAP+LOm9
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process 2908 3032 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3016 wrote to memory of 3032 3016 rundll32.exe 2 PID 3016 wrote to memory of 3032 3016 rundll32.exe 2 PID 3016 wrote to memory of 3032 3016 rundll32.exe 2 PID 3016 wrote to memory of 3032 3016 rundll32.exe 2 PID 3016 wrote to memory of 3032 3016 rundll32.exe 2 PID 3016 wrote to memory of 3032 3016 rundll32.exe 2 PID 3016 wrote to memory of 3032 3016 rundll32.exe 2 PID 3032 wrote to memory of 2908 3032 rundll32.exe 1 PID 3032 wrote to memory of 2908 3032 rundll32.exe 1 PID 3032 wrote to memory of 2908 3032 rundll32.exe 1 PID 3032 wrote to memory of 2908 3032 rundll32.exe 1
Processes
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 3521⤵
- Program crash
PID:2908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3032
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3016