Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
122e17e02bfd692283a85d2d6dbe3068.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
122e17e02bfd692283a85d2d6dbe3068.dll
Resource
win10v2004-20231222-en
General
-
Target
122e17e02bfd692283a85d2d6dbe3068.dll
-
Size
188KB
-
MD5
122e17e02bfd692283a85d2d6dbe3068
-
SHA1
33f692ccc17296d9641867e6d372351dd6c22739
-
SHA256
d577f9934a6567ff79b0dc31d7e3d2187d0407e806f800e9eaa124f44014c635
-
SHA512
14a77d632776d980b4fa1dc07c6a4cf0ba377b7ce024edb411e6bf0500718e6c31f34f23c6f3a232eef0364cdad7c25a41722a5109e63fe394031f83745ae6ad
-
SSDEEP
3072:5H0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWY7dU:5Uua/Pv7YNhRIEZDeXVpAxtMsxK
Malware Config
Extracted
dridex
22201
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
Signatures
-
resource yara_rule behavioral1/memory/2428-0-0x0000000074DD0000-0x0000000074E00000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2828 2428 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2428 2800 rundll32.exe 28 PID 2800 wrote to memory of 2428 2800 rundll32.exe 28 PID 2800 wrote to memory of 2428 2800 rundll32.exe 28 PID 2800 wrote to memory of 2428 2800 rundll32.exe 28 PID 2800 wrote to memory of 2428 2800 rundll32.exe 28 PID 2800 wrote to memory of 2428 2800 rundll32.exe 28 PID 2800 wrote to memory of 2428 2800 rundll32.exe 28 PID 2428 wrote to memory of 2828 2428 rundll32.exe 29 PID 2428 wrote to memory of 2828 2428 rundll32.exe 29 PID 2428 wrote to memory of 2828 2428 rundll32.exe 29 PID 2428 wrote to memory of 2828 2428 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\122e17e02bfd692283a85d2d6dbe3068.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\122e17e02bfd692283a85d2d6dbe3068.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 3083⤵
- Program crash
PID:2828
-
-