Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
c7dcbcb09579c692519aa28deb33c2df.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c7dcbcb09579c692519aa28deb33c2df.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240226-en
General
-
Target
$PLUGINSDIR/INetC.dll
-
Size
21KB
-
MD5
92ec4dd8c0ddd8c4305ae1684ab65fb0
-
SHA1
d850013d582a62e502942f0dd282cc0c29c4310e
-
SHA256
5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
-
SHA512
581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
-
SSDEEP
384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3424 940 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2088 wrote to memory of 940 2088 rundll32.exe 89 PID 2088 wrote to memory of 940 2088 rundll32.exe 89 PID 2088 wrote to memory of 940 2088 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\INetC.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\INetC.dll,#12⤵PID:940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 6243⤵
- Program crash
PID:3424
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 940 -ip 9401⤵PID:1148