Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
d6e8567d4c8c3e6ba6608a2eeef101d0N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d6e8567d4c8c3e6ba6608a2eeef101d0N.dll
Resource
win10v2004-20240709-en
General
-
Target
d6e8567d4c8c3e6ba6608a2eeef101d0N.dll
-
Size
7KB
-
MD5
d6e8567d4c8c3e6ba6608a2eeef101d0
-
SHA1
6685aca11c9a88ff9627e94e9c7d88bf40e3c61a
-
SHA256
96a3c923d429ce87a41574a4e0ca3472f57922c019f3f3d9d912d98195ffd467
-
SHA512
f41e1d435ee39402afc7bea56ed3c82dadeee751a1e442eaee541afcb93a0fafffdf872c33cc9e23aafc79bc1be268fea9031082981b2f6217bb29477d5ba0dd
-
SSDEEP
96:wb4VHccYJUC/aFbz/j0OvaPfd3cX5aXW:wUaJf/aFbP0OE2JaX
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4176 wrote to memory of 3060 4176 rundll32.exe 86 PID 4176 wrote to memory of 3060 4176 rundll32.exe 86 PID 4176 wrote to memory of 3060 4176 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d6e8567d4c8c3e6ba6608a2eeef101d0N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d6e8567d4c8c3e6ba6608a2eeef101d0N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3060
-