Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08/10/2024, 16:51 UTC
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
c17103ae9072a06da581dec998343fc1
-
SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
-
SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
-
SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
SSDEEP
192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 6123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3164 -ip 31641⤵
Network
-
DNS55.36.223.20.in-addr.arpaRemote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse -
DNS197.87.175.4.in-addr.arpaRemote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS139.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request139.190.18.2.in-addr.arpaIN PTRResponse139.190.18.2.in-addr.arpaIN PTRa2-18-190-139deploystaticakamaitechnologiescom
-
DNS13.179.89.13.in-addr.arpaRemote address:8.8.8.8:53Request13.179.89.13.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5355.36.223.20.in-addr.arpadns
DNS Request
55.36.223.20.in-addr.arpa
-
8.8.8.8:53197.87.175.4.in-addr.arpadns
DNS Request
197.87.175.4.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:53139.190.18.2.in-addr.arpadns
DNS Request
139.190.18.2.in-addr.arpa
-
8.8.8.8:5313.179.89.13.in-addr.arpadns
DNS Request
13.179.89.13.in-addr.arpa