Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
126s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
26/07/2024, 16:35
Static task
static1
Behavioral task
behavioral1
Sample
4037245c27678fc1e229545f49c954e987cae452eccb451257571ad42b225bec.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
4037245c27678fc1e229545f49c954e987cae452eccb451257571ad42b225bec.dll
Resource
win11-20240709-en
General
-
Target
4037245c27678fc1e229545f49c954e987cae452eccb451257571ad42b225bec.dll
-
Size
2.8MB
-
MD5
ece73afb919822fdb3f9959bfcb2e17c
-
SHA1
d487b089640e00d47864a41c2041fb5e04abff93
-
SHA256
4037245c27678fc1e229545f49c954e987cae452eccb451257571ad42b225bec
-
SHA512
55f3298bfae83c724625fd226e001d54835f30994cd3f399e5682c62afb8984e2d8148be792588db908f5b3daea1b1d475ccc7051f41dfb17a2f5d6d150a2555
-
SSDEEP
49152:J3t2E41zE47mrBy/mD2jwDpiMDDrTDGDqGNJCtEEYiRWxa+F6mLfnVw:b01YIm1k+DDJr+G40tY4yacLfnV
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1324 wrote to memory of 3016 1324 rundll32.exe 81 PID 1324 wrote to memory of 3016 1324 rundll32.exe 81 PID 1324 wrote to memory of 3016 1324 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4037245c27678fc1e229545f49c954e987cae452eccb451257571ad42b225bec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4037245c27678fc1e229545f49c954e987cae452eccb451257571ad42b225bec.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3016
-