Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08/02/2025, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
6caba6315b19d80df744b6778f2948a1fa213c18f88083682453daa807450e97.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
6caba6315b19d80df744b6778f2948a1fa213c18f88083682453daa807450e97.exe
Resource
win10v2004-20250207-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20250207-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250207-en
General
-
Target
$PLUGINSDIR/LangDLL.dll
-
Size
5KB
-
MD5
f1e9eed02db3a822a7ddef0c724e5f1f
-
SHA1
65864992f5b6c79c5efbefb5b1354648a8a86709
-
SHA256
6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df
-
SHA512
c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c
-
SSDEEP
48:S46+/fTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mjsofjLl:zRuPbOBtWZBV8jAWiAJCdv2Cmj/L
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2396 2288 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2288 2148 rundll32.exe 29 PID 2148 wrote to memory of 2288 2148 rundll32.exe 29 PID 2148 wrote to memory of 2288 2148 rundll32.exe 29 PID 2148 wrote to memory of 2288 2148 rundll32.exe 29 PID 2148 wrote to memory of 2288 2148 rundll32.exe 29 PID 2148 wrote to memory of 2288 2148 rundll32.exe 29 PID 2148 wrote to memory of 2288 2148 rundll32.exe 29 PID 2288 wrote to memory of 2396 2288 rundll32.exe 30 PID 2288 wrote to memory of 2396 2288 rundll32.exe 30 PID 2288 wrote to memory of 2396 2288 rundll32.exe 30 PID 2288 wrote to memory of 2396 2288 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 2283⤵
- Program crash
PID:2396
-
-