Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7ZenStudio_...76.exe
windows11-21h2-x64
7$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ns.dll
windows11-21h2-x64
3$PLUGINSDI...el.dll
windows11-21h2-x64
7$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...dl.dll
windows11-21h2-x64
3ZenStudio.exe
windows11-21h2-x64
1Analysis
-
max time kernel
1460s -
max time network
1488s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/07/2024, 10:08
Behavioral task
behavioral1
Sample
ZenStudio_Setup_v1.5.0_Build_76.exe
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/DotNetChecker.dll
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20240709-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win11-20240709-en
Behavioral task
behavioral8
Sample
ZenStudio.exe
Resource
win11-20240709-en
General
-
Target
$PLUGINSDIR/nsisdl.dll
-
Size
15KB
-
MD5
05f72d6a944e701217ef2eb2cc13e0ee
-
SHA1
fac99c39150ae484e4b3e0af2f4be86bb1835dde
-
SHA256
aab28914794a1cdda4561e9f2af3e006dbed220d9d6bfe049b56d0cb9b783648
-
SHA512
c87e783fc169ef01ac0d3ce29fbfbf349a2e22329df9203a1443cc2caebbe7f8282c0754740289ecca534951cb7e574bafef9ccbaa0da7c287109920ec9573eb
-
SSDEEP
384:hRy180+1ygVaLfKgcIno1gEBWZwCUKihb:hRy180+HSegEBWyQih
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4864 3480 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2916 wrote to memory of 3480 2916 rundll32.exe 81 PID 2916 wrote to memory of 3480 2916 rundll32.exe 81 PID 2916 wrote to memory of 3480 2916 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#12⤵PID:3480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 4923⤵
- Program crash
PID:4864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3480 -ip 34801⤵PID:3504