Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/08/2024, 07:26
Behavioral task
behavioral1
Sample
9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee.dll
Resource
win11-20240802-en
General
-
Target
9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee.dll
-
Size
100KB
-
MD5
832305e8e9ac8b0ad322af793467ad39
-
SHA1
63201c5dda80cd70676386fba87f34968e296de1
-
SHA256
9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee
-
SHA512
3ed725160c8137ed4388cf03afda4dc7b703fa74632dbf2d18e6a15a06e92da6320589b4902938f69e0f7a181a7a75ce5b1fc1708700d2cab876ee980fb23490
-
SSDEEP
1536:EYuo5JWhxuNeduj/zKCUTrTc2BtMQ+qXu/Las0Bpz0xMt+IqLEx:EgJFNegjBOe+Fz0xMt+Ilx
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3016 wrote to memory of 4444 3016 rundll32.exe 81 PID 3016 wrote to memory of 4444 3016 rundll32.exe 81 PID 3016 wrote to memory of 4444 3016 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e6e3083405b8f4d6da3f9db1acd2c2a1d484f2268b638042b8fc3bc41168eee.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4444
-