Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 06:51
Static task
static1
Behavioral task
behavioral1
Sample
d1c584f527baa9d40f46143148aa7468bfafff865f97774c9b252b8d97eaac53.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d1c584f527baa9d40f46143148aa7468bfafff865f97774c9b252b8d97eaac53.dll
Resource
win10v2004-20241007-en
General
-
Target
d1c584f527baa9d40f46143148aa7468bfafff865f97774c9b252b8d97eaac53.dll
-
Size
2.4MB
-
MD5
59d4e0a5de1d99e34639737d3117d041
-
SHA1
d3d4b9b3ea462da31e69111e832a57cfa7de76e7
-
SHA256
d1c584f527baa9d40f46143148aa7468bfafff865f97774c9b252b8d97eaac53
-
SHA512
1680c8319dd6ad05848f9084e04b17d427b75f573ce4f491c4f09dd390cd638ad15da3f9a70a64ac87263628e755ca0d763e6b633d786edb29e316d25511596c
-
SSDEEP
49152:QPUTiZ6xiKzE8iTTJKKTB1hfe6EmIC1lducwaeVTEZzM:QPUpFEhTTV11e6JIC1lducd/ZzM
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1940 4860 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3764 wrote to memory of 4860 3764 rundll32.exe 83 PID 3764 wrote to memory of 4860 3764 rundll32.exe 83 PID 3764 wrote to memory of 4860 3764 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1c584f527baa9d40f46143148aa7468bfafff865f97774c9b252b8d97eaac53.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1c584f527baa9d40f46143148aa7468bfafff865f97774c9b252b8d97eaac53.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 6283⤵
- Program crash
PID:1940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4860 -ip 48601⤵PID:1004