Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
145s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/04/2024, 04:41
Behavioral task
behavioral1
Sample
ConfigureDefender.exe
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win11-20240419-en
Behavioral task
behavioral4
Sample
$_0_/ConfigureDefender_x64.exe
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
$_0_/ConfigureDefender_x86.exe
Resource
win11-20240419-en
General
-
Target
$PLUGINSDIR/nsRandom.dll
-
Size
21KB
-
MD5
ab467b8dfaa660a0f0e5b26e28af5735
-
SHA1
596abd2c31eaff3479edf2069db1c155b59ce74d
-
SHA256
db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
-
SHA512
7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
-
SSDEEP
384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
Malware Config
Signatures
-
resource yara_rule behavioral3/memory/5084-0-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral3/memory/5084-1-0x0000000000400000-0x0000000000412000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2452 5084 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2556 wrote to memory of 5084 2556 rundll32.exe 79 PID 2556 wrote to memory of 5084 2556 rundll32.exe 79 PID 2556 wrote to memory of 5084 2556 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsRandom.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsRandom.dll,#12⤵PID:5084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 4803⤵
- Program crash
PID:2452
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5084 -ip 50841⤵PID:2224