Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2025, 15:13
Behavioral task
behavioral1
Sample
d964b22ec491d3b53b9d82df082ea8a32d9e5ea79b57c95a90d8a1e8ebef7e09N.dll
Resource
win7-20240903-en
General
-
Target
d964b22ec491d3b53b9d82df082ea8a32d9e5ea79b57c95a90d8a1e8ebef7e09N.dll
-
Size
203KB
-
MD5
8aaf828dfb9f5b027dae10972e658850
-
SHA1
a46bef8433c4f4f383c704d767f4854a59cd7189
-
SHA256
d964b22ec491d3b53b9d82df082ea8a32d9e5ea79b57c95a90d8a1e8ebef7e09
-
SHA512
4b66e9c18b19b6600beee28aef76675a80496b5d0a7fcb10b1866dfb7e4d35eff5a2fc7d0e3e6b1ad25cf1afc67484d1821d3fed5679f14e542b83d6169f698a
-
SSDEEP
3072:aJ8IMILmCa3yx6oFEdgVXnF6C9Ugfxm32n7SpiMsQ:5kmCaiEoFEd+F3txm2SpiMz
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1760-0-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/1760-1-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3808 1760 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1760 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4420 wrote to memory of 1760 4420 rundll32.exe 82 PID 4420 wrote to memory of 1760 4420 rundll32.exe 82 PID 4420 wrote to memory of 1760 4420 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d964b22ec491d3b53b9d82df082ea8a32d9e5ea79b57c95a90d8a1e8ebef7e09N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d964b22ec491d3b53b9d82df082ea8a32d9e5ea79b57c95a90d8a1e8ebef7e09N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 7043⤵
- Program crash
PID:3808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1760 -ip 17601⤵PID:2308