Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2025, 00:37
Behavioral task
behavioral1
Sample
9d0edb0611443f59c332eedf4a1c0fcdb439085da25bcc49beca23e8da786f82N.dll
Resource
win7-20241010-en
General
-
Target
9d0edb0611443f59c332eedf4a1c0fcdb439085da25bcc49beca23e8da786f82N.dll
-
Size
203KB
-
MD5
d4b74a8f8580557fc2095cd6a51ad0d0
-
SHA1
010465c4bce83624fb053319511ea3804c82cb77
-
SHA256
9d0edb0611443f59c332eedf4a1c0fcdb439085da25bcc49beca23e8da786f82
-
SHA512
d64670f7773cf8726cb89b591a82b5b5645eca65089c5f37b9d8e55c94ded649800a734daea7b5a83439f60d36c05ee9a0dafa1c697b397aacedd3cef5399c0b
-
SSDEEP
3072:aJ8IMILmCa3yx6oFEdgVXnF6C9Ugfxm32n7SpiM1:5kmCaiEoFEd+F3txm2SpiM1
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3468-0-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/3468-1-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3928 3468 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3468 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5048 wrote to memory of 3468 5048 rundll32.exe 82 PID 5048 wrote to memory of 3468 5048 rundll32.exe 82 PID 5048 wrote to memory of 3468 5048 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d0edb0611443f59c332eedf4a1c0fcdb439085da25bcc49beca23e8da786f82N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d0edb0611443f59c332eedf4a1c0fcdb439085da25bcc49beca23e8da786f82N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 7123⤵
- Program crash
PID:3928
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3468 -ip 34681⤵PID:1544