Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
35b11ae1fb0886847c3b8edd596d1040N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
35b11ae1fb0886847c3b8edd596d1040N.dll
Resource
win10v2004-20240802-en
General
-
Target
35b11ae1fb0886847c3b8edd596d1040N.dll
-
Size
4.6MB
-
MD5
35b11ae1fb0886847c3b8edd596d1040
-
SHA1
3479c50868a03e44597be9dbd386f2b5d2befc7e
-
SHA256
5c7d2b2be50e2ba2545167ce8aa6d1061a24e8f374aadf41938fc371a0658d00
-
SHA512
9dd6ef7fd7bc9b2e4982379ea2239070a8fc523e8eae9f704b29ea4d1fef642df0d8a05033b315dd46e348b3bde0b5732a8c30c6e454ae1179ee38840184845f
-
SSDEEP
98304:2u6vOjpN0H3zgdXgK3c8iBxFs2iqkyyMtFHzkYhAxcikKql3W0:5Bpm2R3ZEtpz5ATkK63r
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2844 rundll32.exe 2844 rundll32.exe 2844 rundll32.exe 2844 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4224 wrote to memory of 2844 4224 rundll32.exe 83 PID 4224 wrote to memory of 2844 4224 rundll32.exe 83 PID 4224 wrote to memory of 2844 4224 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35b11ae1fb0886847c3b8edd596d1040N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35b11ae1fb0886847c3b8edd596d1040N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2844
-