Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1infinst.exe
windows10-1703-x64
4infinst.exe
windows10-2004-x64
4x3daudio1_1.dll
windows10-1703-x64
1x3daudio1_1.dll
windows10-2004-x64
3xactengine2_7.dll
windows10-1703-x64
7xactengine2_7.dll
windows10-2004-x64
7AutoPlay/D...UP.dll
windows10-1703-x64
4AutoPlay/D...UP.dll
windows10-2004-x64
4AutoPlay/D...UP.exe
windows10-1703-x64
4AutoPlay/D...UP.exe
windows10-2004-x64
4AutoPlay/D...S.pptx
windows10-1703-x64
1AutoPlay/D...S.pptx
windows10-2004-x64
1AutoPlay/D...er.exe
windows10-1703-x64
7AutoPlay/D...er.exe
windows10-2004-x64
7AutoPlay/D...32.dll
windows10-1703-x64
4AutoPlay/D...32.dll
windows10-2004-x64
4AutoPlay/D...up.exe
windows10-1703-x64
7AutoPlay/D...up.exe
windows10-2004-x64
7autorun.exe
windows10-1703-x64
3autorun.exe
windows10-2004-x64
3lua5.1.dll
windows10-1703-x64
3lua5.1.dll
windows10-2004-x64
3lua51.dll
windows10-1703-x64
3lua51.dll
windows10-2004-x64
3Analysis
-
max time kernel
1723s -
max time network
1513s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-es -
resource tags
arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
15/02/2023, 04:45
Static task
static1
Behavioral task
behavioral1
Sample
infinst.exe
Resource
win10-20220812-es
Behavioral task
behavioral2
Sample
infinst.exe
Resource
win10v2004-20220812-es
Behavioral task
behavioral3
Sample
x3daudio1_1.dll
Resource
win10-20220901-es
Behavioral task
behavioral4
Sample
x3daudio1_1.dll
Resource
win10v2004-20221111-es
Behavioral task
behavioral5
Sample
xactengine2_7.dll
Resource
win10-20220812-es
Behavioral task
behavioral6
Sample
xactengine2_7.dll
Resource
win10v2004-20221111-es
Behavioral task
behavioral7
Sample
AutoPlay/Docs/DSETUP.dll
Resource
win10-20220812-es
Behavioral task
behavioral8
Sample
AutoPlay/Docs/DSETUP.dll
Resource
win10v2004-20221111-es
Behavioral task
behavioral9
Sample
AutoPlay/Docs/DXSETUP.exe
Resource
win10-20220901-es
Behavioral task
behavioral10
Sample
AutoPlay/Docs/DXSETUP.exe
Resource
win10v2004-20220812-es
Behavioral task
behavioral11
Sample
AutoPlay/Docs/DirectX_11_Technology_Update_US.pptx
Resource
win10-20220812-es
Behavioral task
behavioral12
Sample
AutoPlay/Docs/DirectX_11_Technology_Update_US.pptx
Resource
win10v2004-20221111-es
Behavioral task
behavioral13
Sample
AutoPlay/Docs/VC_RedistInstaller.exe
Resource
win10-20220901-es
Behavioral task
behavioral14
Sample
AutoPlay/Docs/VC_RedistInstaller.exe
Resource
win10v2004-20221111-es
Behavioral task
behavioral15
Sample
AutoPlay/Docs/dsetup32.dll
Resource
win10-20220812-es
Behavioral task
behavioral16
Sample
AutoPlay/Docs/dsetup32.dll
Resource
win10v2004-20221111-es
Behavioral task
behavioral17
Sample
AutoPlay/Docs/setup.exe
Resource
win10-20220812-es
Behavioral task
behavioral18
Sample
AutoPlay/Docs/setup.exe
Resource
win10v2004-20221111-es
Behavioral task
behavioral19
Sample
autorun.exe
Resource
win10-20220812-es
Behavioral task
behavioral20
Sample
autorun.exe
Resource
win10v2004-20221111-es
Behavioral task
behavioral21
Sample
lua5.1.dll
Resource
win10-20220901-es
Behavioral task
behavioral22
Sample
lua5.1.dll
Resource
win10v2004-20221111-es
Behavioral task
behavioral23
Sample
lua51.dll
Resource
win10-20220812-es
Behavioral task
behavioral24
Sample
lua51.dll
Resource
win10v2004-20220812-es
General
-
Target
lua51.dll
-
Size
11KB
-
MD5
7fa818f532effd80cf7c1c54676e5a0d
-
SHA1
05ce44c8d0672c9f3ce66436c592442377e69dba
-
SHA256
1c2d1ba8425139d45de89192d2ae4982e9581f8ae0f22b8497aa0055080237ca
-
SHA512
38baed895bc71bb890e91a92909f6e78ad34569ce6c7efd8bd9db50080da22697a085f98a3465c3e31165fb9029644e5a0f6bc5ba17d71d7f0dcd31784f0811d
-
SSDEEP
192:En9bwibw7JYkjcyFZNcvqr0Py3v7u8meG1+mlXzI+eN1qyOd8cw/RsT9QwHzBDkf:En9ZPvqr0uzu8meYyOd8cqsT9QwHFYf
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 8 4208 WerFault.exe 80 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 868 wrote to memory of 4208 868 rundll32.exe 80 PID 868 wrote to memory of 4208 868 rundll32.exe 80 PID 868 wrote to memory of 4208 868 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lua51.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lua51.dll,#12⤵PID:4208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 6043⤵
- Program crash
PID:8
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4208 -ip 42081⤵PID:1116