Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/06/2024, 05:00

General

  • Target

    $PLUGINSDIR/Aero.dll

  • Size

    7KB

  • MD5

    2329db4688b46b8cde1297575a8fc94c

  • SHA1

    dcaf28dd61992df3ffc64468e1ff487193d83ad8

  • SHA256

    2c58ec428c767ce05e3b2c18ef1e1d9be0d6cd3a97c9f33c95666ea9a66caa9b

  • SHA512

    1e6571c14faab22e6169c21867862bbaacd17bd0d8b589d8403150c62cf022b137428b681d5cffc51b6c772cc04d1213a142f1781dd3a38892daea93e2241994

  • SSDEEP

    192:M6nmPtvco460e35M76v9gTnDg9ZLbG7ChBsZ:UvcoIYKnDg9xhs

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Aero.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Aero.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 220
        3⤵
        • Program crash
        PID:292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2336-2-0x0000000074E60000-0x0000000074E6A000-memory.dmp

    Filesize

    40KB

  • memory/2336-1-0x0000000074E70000-0x0000000074E7A000-memory.dmp

    Filesize

    40KB

  • memory/2336-0-0x0000000074E60000-0x0000000074E6A000-memory.dmp

    Filesize

    40KB

  • memory/2336-3-0x0000000074E70000-0x0000000074E7A000-memory.dmp

    Filesize

    40KB

  • memory/2336-5-0x0000000074E60000-0x0000000074E6A000-memory.dmp

    Filesize

    40KB

  • memory/2336-6-0x0000000074E60000-0x0000000074E6A000-memory.dmp

    Filesize

    40KB