Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
97s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10/08/2024, 22:02 UTC
General
-
Target
Modules/kcpop.dll
-
Size
10KB
-
MD5
44557bf7ff780cfa6019c0c4119fb54a
-
SHA1
e02f00a1f9b9eae1855ca0168c362bd389fd6b8d
-
SHA256
28726ae556cbe1e2b4995ab135da1bfc72d0bc4e4f56d821e95dab738eed61a6
-
SHA512
071c11c89f59397b873d540561bc26f96651b6647f991b34ccdbb22809a16241c5e0167e892d3b660038d3fed5089c20a19eea1ca2a8607acdb6984d84cdf62e
-
SSDEEP
96:kFmxDB0z0dBZHgb0L4cY0v0kNQpuYJ0Fzlk7:kFjzgY0Q0Q
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\kcpop.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\kcpop.dll,#12⤵
- System Location Discovery: System Language Discovery
-
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS30.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
30.243.111.52.in-addr.arpa