Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3RoundedTB_...r3.dll
windows10-2004-x64
1RoundedTB_...r3.dll
windows7-x64
1RoundedTB_...r3.dll
windows10-2004-x64
1RoundedTB_...r3.dll
windows7-x64
1RoundedTB_...r3.dll
windows10-2004-x64
1RoundedTB_...TB.exe
windows7-x64
1RoundedTB_...TB.exe
windows10-2004-x64
1RoundedTB_...ni.dll
windows7-x64
1RoundedTB_...ni.dll
windows10-2004-x64
1RoundedTB_...r3.dll
windows7-x64
1RoundedTB_...r3.dll
windows10-2004-x64
1RoundedTB_...r3.dll
windows7-x64
1RoundedTB_...r3.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
RoundedTB_canary20231016_2/RoundedTB/D3DCompiler_47_cor3.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
RoundedTB_canary20231016_2/RoundedTB/PenImc_cor3.dll
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
RoundedTB_canary20231016_2/RoundedTB/PenImc_cor3.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
RoundedTB_canary20231016_2/RoundedTB/PresentationNative_cor3.dll
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
RoundedTB_canary20231016_2/RoundedTB/PresentationNative_cor3.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
RoundedTB_canary20231016_2/RoundedTB/RoundedTB.exe
Resource
win7-20240215-en
Behavioral task
behavioral7
Sample
RoundedTB_canary20231016_2/RoundedTB/RoundedTB.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
RoundedTB_canary20231016_2/RoundedTB/sni.dll
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
RoundedTB_canary20231016_2/RoundedTB/sni.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
RoundedTB_canary20231016_2/RoundedTB/vcruntime140_cor3.dll
Resource
win7-20240221-en
Behavioral task
behavioral11
Sample
RoundedTB_canary20231016_2/RoundedTB/vcruntime140_cor3.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
RoundedTB_canary20231016_2/RoundedTB/wpfgfx_cor3.dll
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
RoundedTB_canary20231016_2/RoundedTB/wpfgfx_cor3.dll
Resource
win10v2004-20240226-en
General
-
Target
RoundedTB_canary20231016_2/RoundedTB/vcruntime140_cor3.dll
-
Size
106KB
-
MD5
49c96cecda5c6c660a107d378fdfc3d4
-
SHA1
00149b7a66723e3f0310f139489fe172f818ca8e
-
SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
-
SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
-
SSDEEP
1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2468 2208 rundll32.exe 28 PID 2208 wrote to memory of 2468 2208 rundll32.exe 28 PID 2208 wrote to memory of 2468 2208 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\RoundedTB_canary20231016_2\RoundedTB\vcruntime140_cor3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2208 -s 842⤵PID:2468
-