Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 00:21
Static task
static1
Behavioral task
behavioral1
Sample
8c14fb7ff136c2764cae2065436fd3838fb93ee3d9a29bc18a10c1bb09dbe72b.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8c14fb7ff136c2764cae2065436fd3838fb93ee3d9a29bc18a10c1bb09dbe72b.dll
Resource
win10v2004-20240709-en
General
-
Target
8c14fb7ff136c2764cae2065436fd3838fb93ee3d9a29bc18a10c1bb09dbe72b.dll
-
Size
4KB
-
MD5
eb4d7c6652f72251878f36fea9aed5e4
-
SHA1
3e8355b08864399ab47263e7c673f95f60df68d3
-
SHA256
8c14fb7ff136c2764cae2065436fd3838fb93ee3d9a29bc18a10c1bb09dbe72b
-
SHA512
486dd4cd442cb839a0bfc22b79c2789a269d83bb20cb6a4647a41ec9fef7e7ab53ce57f99ef5590cb037ce80ed666c50aa3c6a70772d53aa2ae0fc6bd0f138f9
-
SSDEEP
48:SKLA9oyTnXz+ihZjuLevjB+4IT2Tsv7dN7JJdjYJxlEL:eTnXzvuLerQz1hfJdjYPy
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4284 wrote to memory of 3524 4284 rundll32.exe 84 PID 4284 wrote to memory of 3524 4284 rundll32.exe 84 PID 4284 wrote to memory of 3524 4284 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c14fb7ff136c2764cae2065436fd3838fb93ee3d9a29bc18a10c1bb09dbe72b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c14fb7ff136c2764cae2065436fd3838fb93ee3d9a29bc18a10c1bb09dbe72b.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3524
-