Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
6beda86209a0fc54c5a32140ec29df0d5243fed2af7325e730758498df7b7fb0.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6beda86209a0fc54c5a32140ec29df0d5243fed2af7325e730758498df7b7fb0.dll
Resource
win10v2004-20240802-en
General
-
Target
6beda86209a0fc54c5a32140ec29df0d5243fed2af7325e730758498df7b7fb0.dll
-
Size
63KB
-
MD5
26abab21091a14d0624da80c79c6602e
-
SHA1
382df71dda23ce16fb00dd59eb205a2bcd6db878
-
SHA256
6beda86209a0fc54c5a32140ec29df0d5243fed2af7325e730758498df7b7fb0
-
SHA512
fe26cc81e7e9a64608cfefb9f998088bf36b673b18fc00431e7187e879dd6bc18f5ab6ece1fd17f8732950bb2e83b2a53ad95853184e5d3bbe249a3adb16c387
-
SSDEEP
1536:VPPPOYc6cVL8liSZ3wZCc4RhNW1hSE34UplANEF/YjfL:lXOYdi8g+yCk10UplANbrL
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2736 2408 rundll32.exe 83 PID 2408 wrote to memory of 2736 2408 rundll32.exe 83 PID 2408 wrote to memory of 2736 2408 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6beda86209a0fc54c5a32140ec29df0d5243fed2af7325e730758498df7b7fb0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6beda86209a0fc54c5a32140ec29df0d5243fed2af7325e730758498df7b7fb0.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2736
-