Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 13:26
Behavioral task
behavioral1
Sample
e19086d4bffdec7cef5106993906dff1ffae6280e3a38f0195324bbdf8fc8ef8.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e19086d4bffdec7cef5106993906dff1ffae6280e3a38f0195324bbdf8fc8ef8.dll
Resource
win10v2004-20240802-en
General
-
Target
e19086d4bffdec7cef5106993906dff1ffae6280e3a38f0195324bbdf8fc8ef8.dll
-
Size
244KB
-
MD5
7978d3f1463d0396ecce0a9f073bd30f
-
SHA1
4648664074f0d629aa040e4ee2011d669b7614ad
-
SHA256
e19086d4bffdec7cef5106993906dff1ffae6280e3a38f0195324bbdf8fc8ef8
-
SHA512
f668174eeda11ce35bf27749b7f5c64f4a95044a53f0da2e08d14f9ce00514a28870fd10e61b4a3438a26dbe9a3910757bb147ae2dd7e461e2f34f1a77cd5871
-
SSDEEP
3072:yYaW8qUEflaASmkDs1oo8CUS5D+u73vqQ+z+F62hAxquMfgr5jdUu5VwE:yFHEfoAaDQoo8CUwxTvhU+F66fgtjO
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 368 4280 WerFault.exe 82 1560 4280 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1228 wrote to memory of 4280 1228 rundll32.exe 82 PID 1228 wrote to memory of 4280 1228 rundll32.exe 82 PID 1228 wrote to memory of 4280 1228 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e19086d4bffdec7cef5106993906dff1ffae6280e3a38f0195324bbdf8fc8ef8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e19086d4bffdec7cef5106993906dff1ffae6280e3a38f0195324bbdf8fc8ef8.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 5883⤵
- Program crash
PID:368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 8523⤵
- Program crash
PID:1560
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4280 -ip 42801⤵PID:4564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4280 -ip 42801⤵PID:1164