Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 02:17
Static task
static1
Behavioral task
behavioral1
Sample
4a88841c44d70a605f9760e44e307fc0N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4a88841c44d70a605f9760e44e307fc0N.dll
Resource
win10v2004-20240802-en
General
-
Target
4a88841c44d70a605f9760e44e307fc0N.dll
-
Size
137KB
-
MD5
4a88841c44d70a605f9760e44e307fc0
-
SHA1
1224343248424069717d23ed5a1995a1e0027fa6
-
SHA256
5b1036dc4590322c0a6a5ebc9baa49a7c8b85a84e741dc8ffe9b1d2cea60fb86
-
SHA512
2c74301dfb65665c9ef3c7044839b320a9311ff2fe4347cbeebe4dea0aba2ea60fd3f29e01d34f5262cb85cb686f655dd237e37fd63d7700affdd60e52ccf52c
-
SSDEEP
3072:2t1McBsIfQnUPoJx14twVCqM0k/wz2E929gD/Et7GNGzyl:VcBsBnUPoLuyVCqM9/wbjXIzyl
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4736 wrote to memory of 2888 4736 rundll32.exe 83 PID 4736 wrote to memory of 2888 4736 rundll32.exe 83 PID 4736 wrote to memory of 2888 4736 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a88841c44d70a605f9760e44e307fc0N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a88841c44d70a605f9760e44e307fc0N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2888
-