Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
99s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/08/2024, 02:41 UTC
General
-
Target
c2598139e87f91b2717b846970f135ce43990d435a36530b0e45a6b235013c40.dll
-
Size
5KB
-
MD5
a9efc1296c165ae34cae1945c7c7dfc8
-
SHA1
59999d7b4ea4bc3941905ac8f5a2b65ea6b896d7
-
SHA256
c2598139e87f91b2717b846970f135ce43990d435a36530b0e45a6b235013c40
-
SHA512
042e027c81a84a8f6537ead0481df192dee176f3b08d3a6ee9a45bfd8249d9726fb1cae20612978d5f7b79e75483bc30ef1d9abe35e34598c41a8ec51520a9c5
-
SSDEEP
48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqo2ixIPMCQc1IdDeigc1ICc+TieZHL0iAGM:hy859x0P8MaMCLFi91w+TdlLoGJ3qF
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2598139e87f91b2717b846970f135ce43990d435a36530b0e45a6b235013c40.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2598139e87f91b2717b846970f135ce43990d435a36530b0e45a6b235013c40.dll,#12⤵
- System Location Discovery: System Language Discovery
-
Network
-
DNS69.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request69.190.18.2.in-addr.arpaIN PTRResponse69.190.18.2.in-addr.arpaIN PTRa2-18-190-69deploystaticakamaitechnologiescom -
DNS72.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
DNS157.123.68.40.in-addr.arpaRemote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS73.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request73.190.18.2.in-addr.arpaIN PTRResponse73.190.18.2.in-addr.arpaIN PTRa2-18-190-73deploystaticakamaitechnologiescom
-
DNS77.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request77.190.18.2.in-addr.arpaIN PTRResponse77.190.18.2.in-addr.arpaIN PTRa2-18-190-77deploystaticakamaitechnologiescom
-
DNS77.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request77.190.18.2.in-addr.arpaIN PTR
-
DNS23.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request23.236.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5369.190.18.2.in-addr.arpadns
DNS Request
69.190.18.2.in-addr.arpa
-
8.8.8.8:5372.32.126.40.in-addr.arpadns
DNS Request
72.32.126.40.in-addr.arpa
-
8.8.8.8:53157.123.68.40.in-addr.arpadns
DNS Request
157.123.68.40.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:5373.190.18.2.in-addr.arpadns
DNS Request
73.190.18.2.in-addr.arpa
-
8.8.8.8:5377.190.18.2.in-addr.arpadns
DNS Request
77.190.18.2.in-addr.arpa
DNS Request
77.190.18.2.in-addr.arpa
-
8.8.8.8:5323.236.111.52.in-addr.arpadns
DNS Request
23.236.111.52.in-addr.arpa