Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
77d24dcbb210bbf80704dd2f167c9d1c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
77d24dcbb210bbf80704dd2f167c9d1c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ipa.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ipa.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20231215-en
General
-
Target
$PLUGINSDIR/ipa.dll
-
Size
125KB
-
MD5
0453cd31a00d8b30697def769444a0d1
-
SHA1
932ee994523365d7d3beb65ca6f05e422fd9b588
-
SHA256
84e09bf2fd49b53a081635dffa617c05277212cabce857e0036bc70841e21853
-
SHA512
88c794d028822427a510a0ce988f4694ca5a195336d9e6233d4b523d6ff72f9c394d4cf95a16d391e9f68f0d9296bf922a790669bbcb82f4e3376e8bd307b817
-
SSDEEP
1536:nusH1VQXksIQY6+MqGMpt23cuMz/0Q9YHogbLhfVWAvv3pNAHtCSBnqcHRYZGPdF:ZVVzsIi+HI3X+oxBstDHhVoFQ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3200 1852 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4488 wrote to memory of 1852 4488 rundll32.exe 85 PID 4488 wrote to memory of 1852 4488 rundll32.exe 85 PID 4488 wrote to memory of 1852 4488 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ipa.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ipa.dll,#12⤵PID:1852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 6003⤵
- Program crash
PID:3200
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1852 -ip 18521⤵PID:1944