Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
07ff5290bca33bcd25f479f468f9a0c0371b3aac25dc5bb846b55ba60ca658ed.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
07ff5290bca33bcd25f479f468f9a0c0371b3aac25dc5bb846b55ba60ca658ed.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
sirrah.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
sirrah.dll
Resource
win10v2004-20240704-en
General
-
Target
sirrah.dll
-
Size
52KB
-
MD5
e07ca0e84fc1eeedeccc2dec1e123128
-
SHA1
36731fd829ced121434e80ae92f62c169d949db3
-
SHA256
659d9bf3fbe53372fa97394cc67eb6904c9339a44d0c56a53d5ca1c4dda0c842
-
SHA512
bdf232c7b5784c38d7a0feeb103459cf6534eb6ce63e158efeb269452785219c3051f736ffa53ed20306f1cfa1ac3af6b4a09c8392f3126517d0c0f291772f10
-
SSDEEP
768:kH1nb/WcYwIsw+5ztCjW4UxugTY99imgVt3XJ:kH1nTWc0sw+FtCCVugs+1tnJ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3068 3792 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3696 wrote to memory of 3792 3696 rundll32.exe 82 PID 3696 wrote to memory of 3792 3696 rundll32.exe 82 PID 3696 wrote to memory of 3792 3696 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sirrah.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sirrah.dll,#12⤵PID:3792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 6003⤵
- Program crash
PID:3068
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3792 -ip 37921⤵PID:4444