Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3a785881a9c...25.exe
windows7-x64
3a785881a9c...25.exe
windows10-2004-x64
3$PLUGINSDI...Mg.dll
windows7-x64
1$PLUGINSDI...Mg.dll
windows10-2004-x64
1$PLUGINSDI...LF.dll
windows7-x64
1$PLUGINSDI...LF.dll
windows10-2004-x64
1$PLUGINSDI...qD.dll
windows7-x64
1$PLUGINSDI...qD.dll
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
a785881a9cadb30202026191d72c14636053f85f285027d48b80824240c20025.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a785881a9cadb30202026191d72c14636053f85f285027d48b80824240c20025.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/HFEOcvgSYMg.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/HFEOcvgSYMg.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ZjROYGvOsLF.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ZjROYGvOsLF.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/egfFekpNhqD.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/egfFekpNhqD.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/HFEOcvgSYMg.dll
-
Size
1.2MB
-
MD5
0bf5b0d4c3f8388c62f94a1171297029
-
SHA1
0339a2ff16e6cfbb2e1d35c5880d938391d8b858
-
SHA256
8dd6114cc76b0ff44225dfdb1069b43b7a9fcb78564fbec01e8b86761e63bb22
-
SHA512
bd3fe35c220ad64697b8a141a3b0aefce68c9e1bbebef31e230b339e0ed6ac9f9992b9ad32c1ff10adf56ca9e1c729aafc64a9e477887e9b1116458eec5fd6db
-
SSDEEP
24576:Sj6W4f3Tqh2PYwElC7WZA/evcZkWsCK8Zq:9W462tEoKievcZfsCVZq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2824 2260 rundll32.exe 28 PID 2260 wrote to memory of 2824 2260 rundll32.exe 28 PID 2260 wrote to memory of 2824 2260 rundll32.exe 28 PID 2260 wrote to memory of 2824 2260 rundll32.exe 28 PID 2260 wrote to memory of 2824 2260 rundll32.exe 28 PID 2260 wrote to memory of 2824 2260 rundll32.exe 28 PID 2260 wrote to memory of 2824 2260 rundll32.exe 28