Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 13:49 UTC
Static task
static1
Behavioral task
behavioral1
Sample
b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7.dll
Resource
win10v2004-20240226-en
General
-
Target
b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7.dll
-
Size
107KB
-
MD5
304ccd99a0b27ec17c9dfe4015bace44
-
SHA1
ed315687ab27b915b81e0eee5a917079f0fa0d56
-
SHA256
b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7
-
SHA512
e1b9b918fbb01a22d701c27bae9bc93eef82f3b4f9832174df95bc1f3f4771445db60ffa85894e2361616a25603f0448f4b01ce7070c129a23e1f79179188813
-
SSDEEP
1536:U/kDtfd+YbVzkHPjx+IWG4D1lAe0UsKyqkFzG5jsqAduFnToIfGrS+Ixsk:+/YbVzyPE4SSqjsqAdutTBfGrS+esk
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4052 3060 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4820 wrote to memory of 3060 4820 rundll32.exe 85 PID 4820 wrote to memory of 3060 4820 rundll32.exe 85 PID 4820 wrote to memory of 3060 4820 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7.dll,#12⤵PID:3060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 6323⤵
- Program crash
PID:4052
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3060 -ip 30601⤵PID:4808
Network
-
Remote address:8.8.8.8:53Request183.142.211.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.197.17.2.in-addr.arpaIN PTRResponse240.197.17.2.in-addr.arpaIN PTRa2-17-197-240deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request249.197.17.2.in-addr.arpaIN PTRResponse249.197.17.2.in-addr.arpaIN PTRa2-17-197-249deploystaticakamaitechnologiescom
-
73 B 159 B 1 1
DNS Request
183.142.211.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.160.190.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
240.197.17.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.205.248.87.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
249.197.17.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa
-