Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

#Frée-Fɨ...up.exe

windows7-x64

10

#Frée-Fɨ...up.exe

windows10-2004-x64

10

#Frée-Fɨ...se.dll

windows7-x64

1

#Frée-Fɨ...se.dll

windows10-2004-x64

1

#Frée-Fɨ...-0.dll

windows10-2004-x64

1

#Frée-Fɨ...-0.dll

windows10-2004-x64

1

#Frée-Fɨ...-0.dll

windows10-2004-x64

1

#Frée-Fɨ...-0.dll

windows10-2004-x64

1

#Frée-Fɨ...-0.dll

windows10-2004-x64

1

#Frée-Fɨ...-0.dll

windows10-2004-x64

1

#Frée-Fɨ...-0.dll

windows10-2004-x64

1

#Frée-Fɨ...-0.dll

windows10-2004-x64

1

#Frée-Fɨ...md.dll

windows7-x64

1

#Frée-Fɨ...md.dll

windows10-2004-x64

1

#Frée-Fɨ...h.pptx

windows7-x64

1

#Frée-Fɨ...h.pptx

windows10-2004-x64

1

#Frée-Fɨ...er.exe

windows7-x64

1

#Frée-Fɨ...er.exe

windows10-2004-x64

1

#Frée-Fɨ...40.dll

windows7-x64

1

#Frée-Fɨ...40.dll

windows10-2004-x64

1

#Frée-Fɨ...ib.dll

windows7-x64

1

#Frée-Fɨ...ib.dll

windows10-2004-x64

1

#Frée-Fɨ...er.exe

windows7-x64

1

#Frée-Fɨ...er.exe

windows10-2004-x64

1

#Frée-Fɨ...or.exe

windows7-x64

1

#Frée-Fɨ...or.exe

windows10-2004-x64

1

#Frée-Fɨ...st.dll

windows7-x64

1

#Frée-Fɨ...st.dll

windows10-2004-x64

1

#Frée-Fɨ...ml.dll

windows7-x64

1

#Frée-Fɨ...ml.dll

windows10-2004-x64

1

#Frée-Fɨ...er.dll

windows7-x64

1

#Frée-Fɨ...er.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    03/05/2024, 01:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    #Frée-FɨLéŜ-!PằŜSwṟo͍d--63180/acdbase.dll

  • Size

    2.9MB

  • MD5

    dace23695dcfa0f7309b65366ac75bc0

  • SHA1

    c5b1bad2dec36852fae90f81f0dbd00518479c01

  • SHA256

    cf8b85beeff99b13d06ed15c79e555ab74e30dfa1491a36c4332f54ed09887e4

  • SHA512

    0e1e5fc158fb39c3c3c7733226cb846407cd01ca1c49800fb7668134ebef129ab43030f2768a8b149b5ba9a18b2d1b0f8bf23d1a8de487a482e9268e0b679bbb

  • SSDEEP

    49152:yQzvI/48LzIpH2aTZ70W6pVLOVicH+4T7snimYvtgbgwvWgfFv5COWaUsz7XapvL:yrIpHGpVL7nimatSgSWhOWaUsz7XapvL

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\#Frée-FɨLéŜ-!PằŜSwṟo͍d--63180\acdbase.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2456 -s 84
      2⤵
        PID:3004

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2456-1-0x00000000020C0000-0x00000000024BA000-memory.dmp

      Filesize

      4.0MB

      Download