Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
FabFilter_KeyGen.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
$TEMP/BASSMOD.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$TEMP/R2RFBFKG.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
$TEMP/keygen.exe
Resource
win10v2004-20240508-en
General
-
Target
$TEMP/R2RFBFKG.dll
-
Size
91KB
-
MD5
62695f6fa2a85fc9993f57dfcbdc2749
-
SHA1
07a9b478df63fba4cf3002974b4cf56b404d0914
-
SHA256
1ab33027c4965b027298651781a1c780c272818da189e2c3a8101ac578069260
-
SHA512
69dd0de913629853400106811bffdebd8ec2037c93c9f9820d3f140e84576912de3ab57434086e20cf8698185015c27fa307e06047e2219dcf38a927a36f3c95
-
SSDEEP
1536:NWTHBAtr5cPLOWpTo5iw4AInivibbb+S4A39:0ThAtr5cPLOiaBRIig3
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1276 1328 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 376 wrote to memory of 1328 376 rundll32.exe 82 PID 376 wrote to memory of 1328 376 rundll32.exe 82 PID 376 wrote to memory of 1328 376 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RFBFKG.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RFBFKG.dll,#12⤵PID:1328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 6483⤵
- Program crash
PID:1276
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1328 -ip 13281⤵PID:5092