Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3contactsUX.dll
windows7-x64
3contactsUX.dll
windows10-2004-x64
3msidcrl40.dll
windows7-x64
3msidcrl40.dll
windows10-2004-x64
3msn.exe
windows7-x64
10msn.exe
windows10-2004-x64
10msncore.dll
windows7-x64
3msncore.dll
windows10-2004-x64
3msvcr80.dll
windows7-x64
3msvcr80.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/01/2025, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
contactsUX.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
contactsUX.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
msidcrl40.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
msidcrl40.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
msn.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
msn.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
msncore.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
msncore.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
msvcr80.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
msvcr80.dll
Resource
win10v2004-20241007-en
General
-
Target
msidcrl40.dll
-
Size
784KB
-
MD5
f1f8d156bbdd5945a4f933ac7fa7cc41
-
SHA1
e581235e9f1a3a8a63b8a470eaed882bc93b9085
-
SHA256
344ac8e5debb1a496c3648f941801cdc6ffdfcc7eef8ed38e62270a2e20b1c3a
-
SHA512
86d799af3be251edecf6a552f473b94a0ba2d738b7b5f4a84c31bb34db4ea458f5e50090370bdf82f945e684dd5d66b88ebe3c902305bb0a435aca1331cb4ad9
-
SSDEEP
12288:oqjIhzdNvajtjz38HkZIbKnxPGlJsk7aMCr0:oqjIhzdNvkjGKe1q
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2136 2716 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2716 2236 rundll32.exe 30 PID 2236 wrote to memory of 2716 2236 rundll32.exe 30 PID 2236 wrote to memory of 2716 2236 rundll32.exe 30 PID 2236 wrote to memory of 2716 2236 rundll32.exe 30 PID 2236 wrote to memory of 2716 2236 rundll32.exe 30 PID 2236 wrote to memory of 2716 2236 rundll32.exe 30 PID 2236 wrote to memory of 2716 2236 rundll32.exe 30 PID 2716 wrote to memory of 2136 2716 rundll32.exe 31 PID 2716 wrote to memory of 2136 2716 rundll32.exe 31 PID 2716 wrote to memory of 2136 2716 rundll32.exe 31 PID 2716 wrote to memory of 2136 2716 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msidcrl40.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msidcrl40.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 2603⤵
- Program crash
PID:2136
-
-