Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3a785881a9c...25.exe
windows7-x64
3a785881a9c...25.exe
windows10-2004-x64
3$PLUGINSDI...Mg.dll
windows7-x64
1$PLUGINSDI...Mg.dll
windows10-2004-x64
1$PLUGINSDI...LF.dll
windows7-x64
1$PLUGINSDI...LF.dll
windows10-2004-x64
1$PLUGINSDI...qD.dll
windows7-x64
1$PLUGINSDI...qD.dll
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
a785881a9cadb30202026191d72c14636053f85f285027d48b80824240c20025.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a785881a9cadb30202026191d72c14636053f85f285027d48b80824240c20025.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/HFEOcvgSYMg.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/HFEOcvgSYMg.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ZjROYGvOsLF.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ZjROYGvOsLF.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/egfFekpNhqD.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/egfFekpNhqD.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/egfFekpNhqD.dll
-
Size
900KB
-
MD5
6a83c6814171ee4d4180ef9b044bd971
-
SHA1
5b2a1c981183dac26a0e5ac1c3e0f532673d456c
-
SHA256
a201b0871220c20823e67bccbfe2b25bfcd870d02fd504e9cb2c61c98e272f9b
-
SHA512
1f6887ff78e2bd11e325c2bedf8a3ce0949e558b066755f4aebc0ae465d3c39789ce9c66827bebf1eff7da6c7925830d741cb1664ecfc0460ca2cca64d66063d
-
SSDEEP
12288:51MUBvqIhtn7eJIaxtuQaj+lIUZdhHsXJCU/yi53lFyrB/DlAhfVuztHu:51MUBCU7CjxtYjeIEdh0yQTyIVuzFu
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2368 2880 rundll32.exe 28 PID 2880 wrote to memory of 2368 2880 rundll32.exe 28 PID 2880 wrote to memory of 2368 2880 rundll32.exe 28 PID 2880 wrote to memory of 2368 2880 rundll32.exe 28 PID 2880 wrote to memory of 2368 2880 rundll32.exe 28 PID 2880 wrote to memory of 2368 2880 rundll32.exe 28 PID 2880 wrote to memory of 2368 2880 rundll32.exe 28