Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
7ZenStudio.exe
windows11-21h2-x64
10$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ns.dll
windows11-21h2-x64
3$PLUGINSDI...el.dll
windows11-21h2-x64
7$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...dl.dll
windows11-21h2-x64
3ZenStudio.exe
windows11-21h2-x64
1Analysis
-
max time kernel
455s -
max time network
459s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/05/2024, 17:51
Behavioral task
behavioral1
Sample
ZenStudio.exe
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/DotNetChecker.dll
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
ZenStudio.exe
Resource
win11-20240419-en
General
-
Target
$PLUGINSDIR/nsisdl.dll
-
Size
15KB
-
MD5
05f72d6a944e701217ef2eb2cc13e0ee
-
SHA1
fac99c39150ae484e4b3e0af2f4be86bb1835dde
-
SHA256
aab28914794a1cdda4561e9f2af3e006dbed220d9d6bfe049b56d0cb9b783648
-
SHA512
c87e783fc169ef01ac0d3ce29fbfbf349a2e22329df9203a1443cc2caebbe7f8282c0754740289ecca534951cb7e574bafef9ccbaa0da7c287109920ec9573eb
-
SSDEEP
384:hRy180+1ygVaLfKgcIno1gEBWZwCUKihb:hRy180+HSegEBWyQih
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3740 2240 WerFault.exe 80 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1644 wrote to memory of 2240 1644 rundll32.exe 80 PID 1644 wrote to memory of 2240 1644 rundll32.exe 80 PID 1644 wrote to memory of 2240 1644 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#12⤵PID:2240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 4923⤵
- Program crash
PID:3740
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2240 -ip 22401⤵PID:4832