Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 11:24
Static task
static1
Behavioral task
behavioral1
Sample
f195faf5dc83850235cbde45833b1cf0N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
f195faf5dc83850235cbde45833b1cf0N.dll
Resource
win10v2004-20240802-en
General
-
Target
f195faf5dc83850235cbde45833b1cf0N.dll
-
Size
5KB
-
MD5
f195faf5dc83850235cbde45833b1cf0
-
SHA1
6fa58ab2f7acf43f4067d8a6562beae56018ff88
-
SHA256
8f2d6f5e0e839b279173be14a5a6476514814ee160c092cd9689112be3d3e0dc
-
SHA512
8d65c97324511f89943dfb864ab0564251c4d618bdabd4dc31a1f77b683867397d1f84ee53b6a03aaf1028b01afa8ff8d05adb4434425fc6d4a6fd4138a79101
-
SSDEEP
96:nEY2RrF1eqwi46Q9OAIZnfQdEQd2UEv6QdOemuIsnyOGD:EHRh1eppX9OhZnfQOQgUEv6QEHusOGD
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 540 wrote to memory of 4088 540 rundll32.exe 84 PID 540 wrote to memory of 4088 540 rundll32.exe 84 PID 540 wrote to memory of 4088 540 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f195faf5dc83850235cbde45833b1cf0N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f195faf5dc83850235cbde45833b1cf0N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4088
-