Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2025, 21:23
Behavioral task
behavioral1
Sample
35da7547334065664e3a8233c1215a9b81aadb0e330ff9a9744870db69caaf69.dll
Resource
win7-20241010-en
General
-
Target
35da7547334065664e3a8233c1215a9b81aadb0e330ff9a9744870db69caaf69.dll
-
Size
76KB
-
MD5
c4a3e85a8a64fcf3c4e5b6b23549f224
-
SHA1
44a2052459a62c18a10fe6c4cdadbb628ce23865
-
SHA256
35da7547334065664e3a8233c1215a9b81aadb0e330ff9a9744870db69caaf69
-
SHA512
8446388b761f6198da8005e2cb0214cc98a81eba0b5a49a78ac0f9f73aaebf54deb795ef6d07f030947764509e689d598cdcaf7530a2950c63dd1c86f14664a2
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z2uVd:c8y93KQjy7G55riF1cMo03z
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3380-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3380-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1824 3380 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3380 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4560 wrote to memory of 3380 4560 rundll32.exe 82 PID 4560 wrote to memory of 3380 4560 rundll32.exe 82 PID 4560 wrote to memory of 3380 4560 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35da7547334065664e3a8233c1215a9b81aadb0e330ff9a9744870db69caaf69.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35da7547334065664e3a8233c1215a9b81aadb0e330ff9a9744870db69caaf69.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 7123⤵
- Program crash
PID:1824
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3380 -ip 33801⤵PID:756