Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 06:02
Behavioral task
behavioral1
Sample
f552f1d98ac90746de96d7aaa9ce09943d774c32e9003da4ffe62af309e187d7.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
f552f1d98ac90746de96d7aaa9ce09943d774c32e9003da4ffe62af309e187d7.dll
Resource
win10v2004-20240508-en
General
-
Target
f552f1d98ac90746de96d7aaa9ce09943d774c32e9003da4ffe62af309e187d7.dll
-
Size
76KB
-
MD5
844bbb84315624a9f077b7abc5f555b9
-
SHA1
3fe9027b3de62f1984a6a302ef4db7f9c6639624
-
SHA256
f552f1d98ac90746de96d7aaa9ce09943d774c32e9003da4ffe62af309e187d7
-
SHA512
fb2b70988c08304503fd2aeab64776fc81d8cec0aa97f0c4e31627f0cdcf2e864d35f74c1f77baa6dae796e2e40f359542624172d318cb88564db56577fefb57
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZUo:c8y93KQjy7G55riF1cMo03T
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/1196-0-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/1196-1-0x0000000010000000-0x0000000010030000-memory.dmp UPX -
Modifies AppInit DLL entries 2 TTPs
-
resource yara_rule behavioral2/memory/1196-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/1196-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1216 1196 WerFault.exe 81 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1196 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3276 wrote to memory of 1196 3276 rundll32.exe 81 PID 3276 wrote to memory of 1196 3276 rundll32.exe 81 PID 3276 wrote to memory of 1196 3276 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f552f1d98ac90746de96d7aaa9ce09943d774c32e9003da4ffe62af309e187d7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f552f1d98ac90746de96d7aaa9ce09943d774c32e9003da4ffe62af309e187d7.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 7043⤵
- Program crash
PID:1216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1196 -ip 11961⤵PID:668