Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
Kidux32.dll
windows7-x64
1Kidux32.dll
windows10-2004-x64
1Kidux64.dll
windows7-x64
1Kidux64.dll
windows10-2004-x64
1Qt5Core.exe
windows7-x64
1Qt5Core.exe
windows10-2004-x64
1YouTube Pr....0.exe
windows7-x64
8YouTube Pr....0.exe
windows10-2004-x64
8alocal.exe
windows7-x64
1alocal.exe
windows10-2004-x64
1drivefsext.exe
windows7-x64
1drivefsext.exe
windows10-2004-x64
1Analysis
-
max time kernel
81s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2022, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
Kidux32.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Kidux32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Kidux64.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Kidux64.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Qt5Core.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Qt5Core.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
YouTube Proxy Viewer v1.0.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
YouTube Proxy Viewer v1.0.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
alocal.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
alocal.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
drivefsext.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
drivefsext.exe
Resource
win10v2004-20220812-en
General
-
Target
Kidux32.dll
-
Size
742KB
-
MD5
544cd51a596619b78e9b54b70088307d
-
SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65
-
SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
-
SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
SSDEEP
12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2112 wrote to memory of 4120 2112 rundll32.exe 80 PID 2112 wrote to memory of 4120 2112 rundll32.exe 80 PID 2112 wrote to memory of 4120 2112 rundll32.exe 80