Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
submitted
11/08/2024, 08:24
Behavioral task
behavioral1
Sample
fagality.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fagality.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
fagality.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
fagality.dll
Resource
win11-20240802-en
General
-
Target
fagality.dll
-
Size
36.2MB
-
MD5
36a3ff324f2fe1a9e71f40bf575c936c
-
SHA1
f1ef1d289021000c2f742e7b38518bb0fdbde905
-
SHA256
74a00336a08201483ce04dc30891b077b614cd5023336efac17a5aaa9ddd8b8e
-
SHA512
d4a3753e3261239a45ff54091274c4eafda834387eb7221bd0aa6b6a2d8170f9ba68d07c623903a562ef5f07aff51bfbc214bc93771396027ebba2c1a0e06b2d
-
SSDEEP
393216:w/SBskEyrtN+zJkGsF20dH5ZXtpKjzw1QxgvLqmNAmjpy:UArtN+zJkGsF2OZZXuv4GcLjp
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 1176 2260 WerFault.exe 81 1872 2260 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3272 wrote to memory of 2260 3272 rundll32.exe 81 PID 3272 wrote to memory of 2260 3272 rundll32.exe 81 PID 3272 wrote to memory of 2260 3272 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fagality.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fagality.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 4843⤵
- Program crash
PID:1176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 4523⤵
- Program crash
PID:1872
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2260 -ip 22601⤵PID:5880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2260 -ip 22601⤵PID:5528