Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3a785881a9c...25.exe
windows7-x64
3a785881a9c...25.exe
windows10-2004-x64
3$PLUGINSDI...Mg.dll
windows7-x64
1$PLUGINSDI...Mg.dll
windows10-2004-x64
1$PLUGINSDI...LF.dll
windows7-x64
1$PLUGINSDI...LF.dll
windows10-2004-x64
1$PLUGINSDI...qD.dll
windows7-x64
1$PLUGINSDI...qD.dll
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
a785881a9cadb30202026191d72c14636053f85f285027d48b80824240c20025.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a785881a9cadb30202026191d72c14636053f85f285027d48b80824240c20025.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/HFEOcvgSYMg.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/HFEOcvgSYMg.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ZjROYGvOsLF.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ZjROYGvOsLF.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/egfFekpNhqD.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/egfFekpNhqD.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/ZjROYGvOsLF.dll
-
Size
1.1MB
-
MD5
33aa214d2292caaf0d79c1a7d11c3ef8
-
SHA1
a2588eb18990e4a1071297bfe68bbc065d659e8b
-
SHA256
2a740cd71da20164f5c50db5ecf421194276618c871552f97977aeba6f3c61f2
-
SHA512
934d1aa3f99f68577dacc95e217f4239750124cd3a4cbbc642fe6ffae1531829936ba0c0a1b70a328460cc8f394934cb595ad51065d631cc7ec113cbea96618e
-
SSDEEP
24576:/BFIiefwpioUZq9L8S3Ck4/HOW+mmNYhxY/jrLpushnQDbOEZlB6e:/T1UOW+mHhxY/jrUsiDbOcf6e
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2832 2660 rundll32.exe 28 PID 2660 wrote to memory of 2832 2660 rundll32.exe 28 PID 2660 wrote to memory of 2832 2660 rundll32.exe 28 PID 2660 wrote to memory of 2832 2660 rundll32.exe 28 PID 2660 wrote to memory of 2832 2660 rundll32.exe 28 PID 2660 wrote to memory of 2832 2660 rundll32.exe 28 PID 2660 wrote to memory of 2832 2660 rundll32.exe 28