Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7hlrb11-59cp2009.exe
windows10-1703-x64
7$PLUGINSDI...ns.dll
windows10-1703-x64
3$PLUGINSDI...nu.dll
windows10-1703-x64
3cl_dlls/client.dll
windows10-1703-x64
1dlls/hlrally.dll
windows10-1703-x64
3fmod.dll
windows10-1703-x64
7gfx/env/dmcwft.ps1
windows10-1703-x64
1manual/bugs.htm
windows10-1703-x64
4manual/courses.htm
windows10-1703-x64
4manual/cou...x.html
windows10-1703-x64
4manual/cus...on.htm
windows10-1703-x64
4manual/fra...om.htm
windows10-1703-x64
4manual/frame_top.htm
windows10-1703-x64
4manual/ima...om.htm
windows10-1703-x64
4manual/ima...op.htm
windows10-1703-x64
4manual/ima...x.html
windows10-1703-x64
4manual/ima...ew.htm
windows10-1703-x64
4manual/index.htm
windows10-1703-x64
4manual/overview.htm
windows10-1703-x64
4manual/team.htm
windows10-1703-x64
4manual/vehicles.htm
windows10-1703-x64
4manual/veh...x.html
windows10-1703-x64
4maps/rc_canyon.ps1
windows10-1703-x64
1models/lcr...er.ps1
windows10-1703-x64
1settings.scr
windows10-1703-x64
uninstall.exe
windows10-1703-x64
7$PLUGINSDI...LL.dll
windows10-1703-x64
3user.scr
windows10-1703-x64
zlib.dll
windows10-1703-x64
3Analysis
-
max time kernel
313s -
max time network
412s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
24/02/2024, 18:29
Behavioral task
behavioral1
Sample
hlrb11-59cp2009.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
cl_dlls/client.dll
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
dlls/hlrally.dll
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
fmod.dll
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
gfx/env/dmcwft.ps1
Resource
win10-20240221-en
Behavioral task
behavioral8
Sample
manual/bugs.htm
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
manual/courses.htm
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
manual/courses/index.html
Resource
win10-20240214-en
Behavioral task
behavioral11
Sample
manual/customization.htm
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
manual/frame_bottom.htm
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
manual/frame_top.htm
Resource
win10-20240221-en
Behavioral task
behavioral14
Sample
manual/images/frame_bottom.htm
Resource
win10-20240221-en
Behavioral task
behavioral15
Sample
manual/images/frame_top.htm
Resource
win10-20240221-en
Behavioral task
behavioral16
Sample
manual/images/index.html
Resource
win10-20240221-en
Behavioral task
behavioral17
Sample
manual/images/overview.htm
Resource
win10-20240221-en
Behavioral task
behavioral18
Sample
manual/index.htm
Resource
win10-20240221-en
Behavioral task
behavioral19
Sample
manual/overview.htm
Resource
win10-20240221-en
Behavioral task
behavioral20
Sample
manual/team.htm
Resource
win10-20240221-en
Behavioral task
behavioral21
Sample
manual/vehicles.htm
Resource
win10-20240214-en
Behavioral task
behavioral22
Sample
manual/vehicles/index.html
Resource
win10-20240221-en
Behavioral task
behavioral23
Sample
maps/rc_canyon.ps1
Resource
win10-20240221-en
Behavioral task
behavioral24
Sample
models/lcreek/9boulder.ps1
Resource
win10-20240221-en
Behavioral task
behavioral25
Sample
settings.scr
Resource
win10-20240221-en
Behavioral task
behavioral26
Sample
uninstall.exe
Resource
win10-20240221-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10-20240221-en
Behavioral task
behavioral28
Sample
user.scr
Resource
win10-20240221-en
Behavioral task
behavioral29
Sample
zlib.dll
Resource
win10-20240221-en
General
-
Target
fmod.dll
-
Size
144KB
-
MD5
e3ea5ddaa55a500623ea14fa209112b5
-
SHA1
a9237187b5e7a7714492908d2f5c29542f834d5d
-
SHA256
a0fff211d1a703be35c8204d7721ac9d021b25694fbec0c22c6398ce95eff3eb
-
SHA512
4888a2cf0cfb1e3bf2ca8627c0384a9ded034b85f60aeab567fb4b160426bce2dbf5696e3e3c96d1f85d08c7aedd1245924f6eb6bbd3977bd418acd5e699d581
-
SSDEEP
3072:zLEYjXzKQ45duSoycNI4XaCSHSTJHArMBiiAZid9zFq:zwYrzj4ovX6KHAgBdAZI9g
Malware Config
Signatures
-
resource yara_rule behavioral6/memory/1268-0-0x0000000010000000-0x0000000010091000-memory.dmp upx behavioral6/memory/1268-1-0x0000000010000000-0x0000000010091000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 4080 1268 WerFault.exe 71 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1268 1016 rundll32.exe 71 PID 1016 wrote to memory of 1268 1016 rundll32.exe 71 PID 1016 wrote to memory of 1268 1016 rundll32.exe 71
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fmod.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fmod.dll,#12⤵PID:1268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 6803⤵
- Program crash
PID:4080
-
-