Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

ec1509dc8d...77.dll

windows7-x64

1

ec1509dc8d...77.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2024, 09:32 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ec1509dc8d42882c46d3aeedca6c02d34e08c3e1b2f0f540bff8ca97bb5cfc77.dll

  • Size

    2.2MB

  • MD5

    d3c411786eb344ba899d972aae9ca2c9

  • SHA1

    90b0ccacd06cfbda9d7d144290face671536844c

  • SHA256

    ec1509dc8d42882c46d3aeedca6c02d34e08c3e1b2f0f540bff8ca97bb5cfc77

  • SHA512

    7cc43169433fc0cf4f03bcbfa7fa96c421cd31f732bdde890ec17798a56dbc87c7a09d0d3dfaae71a9868411cfaf0adc8d34f5cd77f3ec305a4dea7ea95036e3

  • SSDEEP

    49152:TJd0OM54ym/8RgJhYM97tQjFozL19wNa/WgI:VCOM5zyJcjFKp9JWgI

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec1509dc8d42882c46d3aeedca6c02d34e08c3e1b2f0f540bff8ca97bb5cfc77.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec1509dc8d42882c46d3aeedca6c02d34e08c3e1b2f0f540bff8ca97bb5cfc77.dll,#1
      2⤵
        PID:4520
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 560
          3⤵
          • Program crash
          PID:1208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4520 -ip 4520
      1⤵
        PID:4904

      Network

      • flag-us
        DNS
        209.205.72.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        209.205.72.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        17.160.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        17.160.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.150.49.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.150.49.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        16.234.44.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        16.234.44.23.in-addr.arpa
        IN PTR
        Response
        16.234.44.23.in-addr.arpa
        IN PTR
        a23-44-234-16deploystaticakamaitechnologiescom
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        217.135.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.135.221.88.in-addr.arpa
        IN PTR
        Response
        217.135.221.88.in-addr.arpa
        IN PTR
        a88-221-135-217deploystaticakamaitechnologiescom
      • flag-us
        DNS
        208.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        208.178.17.96.in-addr.arpa
        IN PTR
        Response
        208.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-208deploystaticakamaitechnologiescom
      • flag-us
        DNS
        180.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        180.178.17.96.in-addr.arpa
        IN PTR
        Response
        180.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-180deploystaticakamaitechnologiescom
      • flag-us
        DNS
        27.73.42.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        27.73.42.20.in-addr.arpa
        IN PTR
        Response
      • 138.91.171.81:80
        52 B
         1
      • 8.8.8.8:53
        209.205.72.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        209.205.72.20.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        17.160.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        17.160.190.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        241.150.49.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        241.150.49.20.in-addr.arpa

      • 8.8.8.8:53
        16.234.44.23.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        16.234.44.23.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        71 B
         145 B
         1
        1

        DNS Request

        206.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        217.135.221.88.in-addr.arpa
        dns
        73 B
         139 B
         1
        1

        DNS Request

        217.135.221.88.in-addr.arpa

      • 8.8.8.8:53
        208.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        208.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        180.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        180.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        27.73.42.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        27.73.42.20.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.