Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8CADe_SIMUd...CN.exe
windows7-x64
1CADe_SIMUd...CN.exe
windows10-2004-x64
1CADe_SIMUd...2D.dll
windows7-x64
1CADe_SIMUd...2D.dll
windows10-2004-x64
1CADe_SIMUd...2D.dll
windows7-x64
1CADe_SIMUd...2D.dll
windows10-2004-x64
1CADe_SIMUd...TD.dll
windows7-x64
3CADe_SIMUd...TD.dll
windows10-2004-x64
3Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2022, 04:33
Behavioral task
behavioral1
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/CADe_SIMU CN.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/CADe_SIMU CN.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFC42D.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFC42D.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFCO42D.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFCO42D.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MSVCRTD.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MSVCRTD.dll
Resource
win10v2004-20220812-en
General
-
Target
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFC42D.dll
-
Size
363KB
-
MD5
59c86163380f19a105d5aacfc4271d3e
-
SHA1
5648be24e833c94c9fcde56d6dd6de41d509858a
-
SHA256
2ad8a8bfef59c00b224ccad342803ad61ea9f1c7ccd600d4fa8ca5f77e44e360
-
SHA512
5c7b693634be22cc5f793bb2daeb80436168c41efdf6060eccdd985a93222364f0f44b1e979adc4a11361785f6453e8d8766e941b10129887b82f0ab4068dfe2
-
SSDEEP
6144:gOuz3Yu36kel0KaX4T1l7GAj6MH88z7uwljaUlCTks2fBk22sty49cD6QV9d:mz3z3nxKaXgsu6srB1t8D6K9d
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4384 wrote to memory of 4928 4384 rundll32.exe 82 PID 4384 wrote to memory of 4928 4384 rundll32.exe 82 PID 4384 wrote to memory of 4928 4384 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MFC42D.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MFC42D.dll,#12⤵PID:4928
-