Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 23:23
Behavioral task
behavioral1
Sample
910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee.dll
Resource
win10v2004-20240226-en
General
-
Target
910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee.dll
-
Size
76KB
-
MD5
ada62f8c6739afd1e3dcc62e8914ef96
-
SHA1
eb22bbaf8d4b0702dc60b545110a7184a8e62402
-
SHA256
910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee
-
SHA512
6d4374f1c804b5ce3ca2e7651100a6833faae78f03e0538e66a7de407e71aa7041bfe2c5016e4b0f6f4ba06fec6d337508f83916b251f06c9e9bd5451f3fd099
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZgNs:c8y93KQjy7G55riF1cMo03Z
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/2952-0-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2952-1-0x0000000010000000-0x0000000010030000-memory.dmp UPX -
Modifies AppInit DLL entries 2 TTPs
-
resource yara_rule behavioral2/memory/2952-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2952-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2908 2952 WerFault.exe 88 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2952 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2952 3060 rundll32.exe 88 PID 3060 wrote to memory of 2952 3060 rundll32.exe 88 PID 3060 wrote to memory of 2952 3060 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 7043⤵
- Program crash
PID:2908
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2952 -ip 29521⤵PID:4524