Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09/09/2024, 20:54 UTC
General
-
Target
modules/module13.dll
-
Size
12KB
-
MD5
d1033c0380feca299f426230b9ce4148
-
SHA1
1909e5537743d7998fd151bd53da5446b7c5f795
-
SHA256
dce65aae626cb16dab83413c0a82870a25213835f7302de7208dd869304b0717
-
SHA512
7dfc0c5dbce33e7d40f22fc19d11006d3be3e414a5d3a71f98e8abb8ea7e138de20f505ea80617d4016514ae39b5a361836081fe231a917eb0b2e644f426b139
-
SSDEEP
192:OEzCa1afURmAZsKdbK8wiLa8SakXVPS3EVqivExjw:OEzvafvPcbTFZSamM3EMd
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\modules\module13.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\modules\module13.dll,#12⤵
- System Location Discovery: System Language Discovery
-
Network
-
DNS149.220.183.52.in-addr.arpaRemote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse -
DNS45.56.20.217.in-addr.arpaRemote address:8.8.8.8:53Request45.56.20.217.in-addr.arpaIN PTRResponse
-
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS69.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request69.190.18.2.in-addr.arpaIN PTRResponse69.190.18.2.in-addr.arpaIN PTRa2-18-190-69deploystaticakamaitechnologiescom
-
DNS21.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:53149.220.183.52.in-addr.arpadns
DNS Request
149.220.183.52.in-addr.arpa
-
8.8.8.8:5345.56.20.217.in-addr.arpadns
DNS Request
45.56.20.217.in-addr.arpa
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:5369.190.18.2.in-addr.arpadns
DNS Request
69.190.18.2.in-addr.arpa
-
8.8.8.8:5321.236.111.52.in-addr.arpadns
DNS Request
21.236.111.52.in-addr.arpa