Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 16:53
Behavioral task
behavioral1
Sample
a44b170ebd165cae3d41a6bc5a1133c22356b7cf9aa799e6b725f00a7c94b760.dll
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
a44b170ebd165cae3d41a6bc5a1133c22356b7cf9aa799e6b725f00a7c94b760.dll
Resource
win10v2004-20241007-en
General
-
Target
a44b170ebd165cae3d41a6bc5a1133c22356b7cf9aa799e6b725f00a7c94b760.dll
-
Size
185KB
-
MD5
6a8735a8ceed0c17c4ff09df3a566e54
-
SHA1
2e35de48f1809c1172eea9647865774c85943c48
-
SHA256
a44b170ebd165cae3d41a6bc5a1133c22356b7cf9aa799e6b725f00a7c94b760
-
SHA512
86f2856f884dab05b5c0511ff10bad4c0a3654c0fd06270a5792089036a76d5f663f77a93ee0c10815f47a1f77561a6bdedcf41f86e5f8dc97d822ce21bddebb
-
SSDEEP
3072:mALwSP/YJ3CKSSLmjm4UwRJhycMOD++lvtdv5TWyT:mgZYXmjm4UXcx77Rl
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2560 396 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1724 wrote to memory of 396 1724 rundll32.exe 83 PID 1724 wrote to memory of 396 1724 rundll32.exe 83 PID 1724 wrote to memory of 396 1724 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a44b170ebd165cae3d41a6bc5a1133c22356b7cf9aa799e6b725f00a7c94b760.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a44b170ebd165cae3d41a6bc5a1133c22356b7cf9aa799e6b725f00a7c94b760.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 6243⤵
- Program crash
PID:2560
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 396 -ip 3961⤵PID:4608