Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7hlrb11-59cp2009.exe
windows10-1703-x64
7$PLUGINSDI...ns.dll
windows10-1703-x64
3$PLUGINSDI...nu.dll
windows10-1703-x64
3cl_dlls/client.dll
windows10-1703-x64
1dlls/hlrally.dll
windows10-1703-x64
3fmod.dll
windows10-1703-x64
7gfx/env/dmcwft.ps1
windows10-1703-x64
1manual/bugs.htm
windows10-1703-x64
4manual/courses.htm
windows10-1703-x64
4manual/cou...x.html
windows10-1703-x64
4manual/cus...on.htm
windows10-1703-x64
4manual/fra...om.htm
windows10-1703-x64
4manual/frame_top.htm
windows10-1703-x64
4manual/ima...om.htm
windows10-1703-x64
4manual/ima...op.htm
windows10-1703-x64
4manual/ima...x.html
windows10-1703-x64
4manual/ima...ew.htm
windows10-1703-x64
4manual/index.htm
windows10-1703-x64
4manual/overview.htm
windows10-1703-x64
4manual/team.htm
windows10-1703-x64
4manual/vehicles.htm
windows10-1703-x64
4manual/veh...x.html
windows10-1703-x64
4maps/rc_canyon.ps1
windows10-1703-x64
1models/lcr...er.ps1
windows10-1703-x64
1settings.scr
windows10-1703-x64
uninstall.exe
windows10-1703-x64
7$PLUGINSDI...LL.dll
windows10-1703-x64
3user.scr
windows10-1703-x64
zlib.dll
windows10-1703-x64
3Analysis
-
max time kernel
293s -
max time network
325s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
24/02/2024, 18:29
Behavioral task
behavioral1
Sample
hlrb11-59cp2009.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
cl_dlls/client.dll
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
dlls/hlrally.dll
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
fmod.dll
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
gfx/env/dmcwft.ps1
Resource
win10-20240221-en
Behavioral task
behavioral8
Sample
manual/bugs.htm
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
manual/courses.htm
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
manual/courses/index.html
Resource
win10-20240214-en
Behavioral task
behavioral11
Sample
manual/customization.htm
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
manual/frame_bottom.htm
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
manual/frame_top.htm
Resource
win10-20240221-en
Behavioral task
behavioral14
Sample
manual/images/frame_bottom.htm
Resource
win10-20240221-en
Behavioral task
behavioral15
Sample
manual/images/frame_top.htm
Resource
win10-20240221-en
Behavioral task
behavioral16
Sample
manual/images/index.html
Resource
win10-20240221-en
Behavioral task
behavioral17
Sample
manual/images/overview.htm
Resource
win10-20240221-en
Behavioral task
behavioral18
Sample
manual/index.htm
Resource
win10-20240221-en
Behavioral task
behavioral19
Sample
manual/overview.htm
Resource
win10-20240221-en
Behavioral task
behavioral20
Sample
manual/team.htm
Resource
win10-20240221-en
Behavioral task
behavioral21
Sample
manual/vehicles.htm
Resource
win10-20240214-en
Behavioral task
behavioral22
Sample
manual/vehicles/index.html
Resource
win10-20240221-en
Behavioral task
behavioral23
Sample
maps/rc_canyon.ps1
Resource
win10-20240221-en
Behavioral task
behavioral24
Sample
models/lcreek/9boulder.ps1
Resource
win10-20240221-en
Behavioral task
behavioral25
Sample
settings.scr
Resource
win10-20240221-en
Behavioral task
behavioral26
Sample
uninstall.exe
Resource
win10-20240221-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10-20240221-en
Behavioral task
behavioral28
Sample
user.scr
Resource
win10-20240221-en
Behavioral task
behavioral29
Sample
zlib.dll
Resource
win10-20240221-en
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
0285eac59530ff5cc91fe2634b4ed78e
-
SHA1
241c12aefca0740e776362f30aa1edffd66d6bdc
-
SHA256
44c822afaa4cc7cb95390eaa0ada076d280d3455870569f0cde03637257d9899
-
SHA512
1007fbfb82d4e6c04bd5fefb32cd81f4406022ceef4d409eda0f0ddeb8b1f124a2baec86498bc119778e0c241fc41b0c2440d8a8f6731a63ede936be94f81297
-
SSDEEP
192:8nK6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+MTgK72dwF7dBEnbok:8K6UdHXcIiY535zBtMTg+BEnbo
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4988 992 WerFault.exe 72 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5004 wrote to memory of 992 5004 rundll32.exe 72 PID 5004 wrote to memory of 992 5004 rundll32.exe 72 PID 5004 wrote to memory of 992 5004 rundll32.exe 72
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵PID:992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 6443⤵
- Program crash
PID:4988
-
-