Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3a785881a9c...25.exe
windows7-x64
3a785881a9c...25.exe
windows10-2004-x64
3$PLUGINSDI...Mg.dll
windows7-x64
1$PLUGINSDI...Mg.dll
windows10-2004-x64
1$PLUGINSDI...LF.dll
windows7-x64
1$PLUGINSDI...LF.dll
windows10-2004-x64
1$PLUGINSDI...qD.dll
windows7-x64
1$PLUGINSDI...qD.dll
windows10-2004-x64
1Analysis
-
max time kernel
91s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
a785881a9cadb30202026191d72c14636053f85f285027d48b80824240c20025.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a785881a9cadb30202026191d72c14636053f85f285027d48b80824240c20025.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/HFEOcvgSYMg.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/HFEOcvgSYMg.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ZjROYGvOsLF.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ZjROYGvOsLF.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/egfFekpNhqD.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/egfFekpNhqD.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/HFEOcvgSYMg.dll
-
Size
1.2MB
-
MD5
0bf5b0d4c3f8388c62f94a1171297029
-
SHA1
0339a2ff16e6cfbb2e1d35c5880d938391d8b858
-
SHA256
8dd6114cc76b0ff44225dfdb1069b43b7a9fcb78564fbec01e8b86761e63bb22
-
SHA512
bd3fe35c220ad64697b8a141a3b0aefce68c9e1bbebef31e230b339e0ed6ac9f9992b9ad32c1ff10adf56ca9e1c729aafc64a9e477887e9b1116458eec5fd6db
-
SSDEEP
24576:Sj6W4f3Tqh2PYwElC7WZA/evcZkWsCK8Zq:9W462tEoKievcZfsCVZq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3620 wrote to memory of 2400 3620 rundll32.exe 83 PID 3620 wrote to memory of 2400 3620 rundll32.exe 83 PID 3620 wrote to memory of 2400 3620 rundll32.exe 83