Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 19:07
Behavioral task
behavioral1
Sample
de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll
Resource
win10v2004-20240226-en
General
-
Target
de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll
-
Size
648KB
-
MD5
773ee7c6340a3b637f1d469c10753895
-
SHA1
640999f3973a354e6bd99ce13ce5936802644679
-
SHA256
de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3
-
SHA512
f61864c918448b3b275e8df8e536bff16501283400377bd0850c327cd3b3d872ea48349f34381d5f7e1eb6661a7b83a4e8b04dd84c180726a0230776139018a6
-
SSDEEP
12288:HjsgiZdvAeRwz+agHL50cCJeBqWycvpWwXkmvRKLiTOksRpFHDIkGiIjcBDQg5Ey:DsgwdvAKrr50cCJeBqW/vpfXkmvR+iT4
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
resource yara_rule behavioral2/memory/4680-0-0x0000000074CD0000-0x0000000074D72000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Program crash 2 IoCs
pid pid_target Process procid_target 2500 4680 WerFault.exe 85 5088 4680 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4952 wrote to memory of 4680 4952 rundll32.exe 85 PID 4952 wrote to memory of 4680 4952 rundll32.exe 85 PID 4952 wrote to memory of 4680 4952 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll,#12⤵PID:4680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 6043⤵
- Program crash
PID:2500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 6123⤵
- Program crash
PID:5088
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4680 -ip 46801⤵PID:4692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4680 -ip 46801⤵PID:3420