Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 07:26
Behavioral task
behavioral1
Sample
9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee.dll
Resource
win11-20240802-en
General
-
Target
9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee.dll
-
Size
100KB
-
MD5
832305e8e9ac8b0ad322af793467ad39
-
SHA1
63201c5dda80cd70676386fba87f34968e296de1
-
SHA256
9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee
-
SHA512
3ed725160c8137ed4388cf03afda4dc7b703fa74632dbf2d18e6a15a06e92da6320589b4902938f69e0f7a181a7a75ce5b1fc1708700d2cab876ee980fb23490
-
SSDEEP
1536:EYuo5JWhxuNeduj/zKCUTrTc2BtMQ+qXu/Las0Bpz0xMt+IqLEx:EgJFNegjBOe+Fz0xMt+Ilx
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5036 wrote to memory of 4184 5036 rundll32.exe 84 PID 5036 wrote to memory of 4184 5036 rundll32.exe 84 PID 5036 wrote to memory of 4184 5036 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4184
-