Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 10:50
Behavioral task
behavioral1
Sample
d342688b2a6386be857e780366bce19cdc6044f75d77e055ea115fd3421eb43fN.dll
Resource
win7-20240903-en
General
-
Target
d342688b2a6386be857e780366bce19cdc6044f75d77e055ea115fd3421eb43fN.dll
-
Size
76KB
-
MD5
c075ba84e782cd7e68df9b40736471d0
-
SHA1
fdaee32522d0b696c798d29744f5d71a2dc9222e
-
SHA256
d342688b2a6386be857e780366bce19cdc6044f75d77e055ea115fd3421eb43f
-
SHA512
faef307acee0e5981bc30653fc079581ff62cfeb6a783e337d17b7c4de977097c85cebc9cd7f713a4a201bb143aac90cba331c330efbc56d62084898738ea4b8
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZB2i+x4:c8y93KQjy7G55riF1cMo0377+x4
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2588-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2588-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3132 2588 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2588 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3324 wrote to memory of 2588 3324 rundll32.exe 82 PID 3324 wrote to memory of 2588 3324 rundll32.exe 82 PID 3324 wrote to memory of 2588 3324 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d342688b2a6386be857e780366bce19cdc6044f75d77e055ea115fd3421eb43fN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d342688b2a6386be857e780366bce19cdc6044f75d77e055ea115fd3421eb43fN.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 7123⤵
- Program crash
PID:3132
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2588 -ip 25881⤵PID:1744