Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 07:29
Behavioral task
behavioral1
Sample
35de58beb7c49d16c1c3a931986383965ef292275fa0a5be1380926a7e45a618N.dll
Resource
win7-20240903-en
General
-
Target
35de58beb7c49d16c1c3a931986383965ef292275fa0a5be1380926a7e45a618N.dll
-
Size
76KB
-
MD5
c1047a359f07bf10c3a51048da3b8a80
-
SHA1
282d0e078f058cc9c3cefc37544eec30343f1dab
-
SHA256
35de58beb7c49d16c1c3a931986383965ef292275fa0a5be1380926a7e45a618
-
SHA512
2fbee5b4b705a9155d0f44e2945004430a345b72158d08240aa1aae28880dc7862e72de33f93d2c1d38e30aadfde75cbc709ae584621c94585b78e11b50404b9
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zs5//:c8y93KQjy7G55riF1cMo03W53
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4836-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4836-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3332 4836 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4836 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3204 wrote to memory of 4836 3204 rundll32.exe 82 PID 3204 wrote to memory of 4836 3204 rundll32.exe 82 PID 3204 wrote to memory of 4836 3204 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35de58beb7c49d16c1c3a931986383965ef292275fa0a5be1380926a7e45a618N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35de58beb7c49d16c1c3a931986383965ef292275fa0a5be1380926a7e45a618N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 7003⤵
- Program crash
PID:3332
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4836 -ip 48361⤵PID:4676