Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
b858e39ded00805b735668b7f313a9a1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b858e39ded00805b735668b7f313a9a1.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$_5_.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$_5_.dll
Resource
win10v2004-20240226-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
10KB
-
MD5
32465a07028b927b22c38e642c2cb836
-
SHA1
309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
-
SHA256
eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
-
SHA512
9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
-
SSDEEP
192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2008 2580 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3412 wrote to memory of 2580 3412 rundll32.exe 89 PID 3412 wrote to memory of 2580 3412 rundll32.exe 89 PID 3412 wrote to memory of 2580 3412 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵PID:2580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 6123⤵
- Program crash
PID:2008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2580 -ip 25801⤵PID:1948