Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06.dll
Resource
win10v2004-20240226-en
General
-
Target
d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06.dll
-
Size
1.3MB
-
MD5
b8f1dffb6f7d941f68af0fd3e9b2d62b
-
SHA1
11f66f050551cbccd6cf6a074b70bcf5485519af
-
SHA256
d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06
-
SHA512
4edb044c9e148f3b5c05d54f403437ab59110e3e01dda4535a4611662ec6574b02e15f77e746d1283e0385c9f70cd2416b0ed33bc53fae34b08b8d7e0380d17a
-
SSDEEP
24576:3RT0EtXhsVDLgQsSulh2Z6ytyFJpckYatFaC4sg2F2eB91hmcH32+6bKstEBrEHf:BYEXsN9clsZQplrdg2EeZQcH3+tEQ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 696 1504 WerFault.exe 92 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3588 wrote to memory of 1504 3588 rundll32.exe 92 PID 3588 wrote to memory of 1504 3588 rundll32.exe 92 PID 3588 wrote to memory of 1504 3588 rundll32.exe 92
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06.dll,#12⤵PID:1504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 5603⤵
- Program crash
PID:696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1504 -ip 15041⤵PID:3708
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:4900