Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 11:07
Behavioral task
behavioral1
Sample
d533ef455ce7d4761b0c57ef90f6a3052f72e6f5f9180e42d09b1a2430713a00.dll
Resource
win7-20240708-en
General
-
Target
d533ef455ce7d4761b0c57ef90f6a3052f72e6f5f9180e42d09b1a2430713a00.dll
-
Size
744KB
-
MD5
c3fa56199c6df09290e6cf0a7387936e
-
SHA1
0c90da3581628c28685725706079a3382c51cf1f
-
SHA256
d533ef455ce7d4761b0c57ef90f6a3052f72e6f5f9180e42d09b1a2430713a00
-
SHA512
4fa9e5757ae3e150baf4bce219efc7ac19f76a5be2269ea49ce2b590b58299d1b8bd051cfdd07a1007fe66bc093911a953339a3c45cf8fe7a2784413e722330f
-
SSDEEP
12288:tf68zjnT+2a8+p0/IARbJkale360zCA9JK7LdBzSZd6Z/+rXm5AQKa8/VyFcajNp:tjjny2a8S0/1EaleYUKn2ZY2TmAQN0Vi
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2204-0-0x0000000000400000-0x00000000005B4000-memory.dmp vmprotect behavioral2/memory/2204-1-0x0000000000400000-0x00000000005B4000-memory.dmp vmprotect behavioral2/memory/2204-2-0x0000000000400000-0x00000000005B4000-memory.dmp vmprotect -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 764 wrote to memory of 2204 764 rundll32.exe 84 PID 764 wrote to memory of 2204 764 rundll32.exe 84 PID 764 wrote to memory of 2204 764 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d533ef455ce7d4761b0c57ef90f6a3052f72e6f5f9180e42d09b1a2430713a00.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d533ef455ce7d4761b0c57ef90f6a3052f72e6f5f9180e42d09b1a2430713a00.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2204
-