Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 09:55
Behavioral task
behavioral1
Sample
3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77cN.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77cN.dll
Resource
win10v2004-20241007-en
General
-
Target
3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77cN.dll
-
Size
2.9MB
-
MD5
fa83b61bd3076462a4ee6f59cdb1c3b0
-
SHA1
3dea170071d9a5502ab5592aa49feae5cec3855b
-
SHA256
3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77c
-
SHA512
5634286cee6fc6a989ba4cb4625e224c2c756fd78b95b188efcb0c791b4c6ac2a5546db346770e511ff7ab52e730d1418fd2b0c32cf859c8d5378ea64e291079
-
SSDEEP
49152:0Y6LfuhifICeZNZfNpNT+3/lGFi7YtXyCbJXPqEAQ2wQrtJmzys2gzG:iLb3ejZg3NGQ7YACbStwQrtGy2zG
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4812 wrote to memory of 32 4812 rundll32.exe 82 PID 4812 wrote to memory of 32 4812 rundll32.exe 82 PID 4812 wrote to memory of 32 4812 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77cN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77cN.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:32
-