990c72378a5ad30adc76cf8142997bcae5b7c698ba1cb80ac73f9a54bce593db

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

res/mods/x...t__.py

windows7-x64

res/mods/x...t__.py

windows10-2004-x64

res/mods/x...__.pyc

windows7-x64

res/mods/x...__.pyc

windows10-2004-x64

res/mods/x...__.pyc

windows7-x64

res/mods/x...__.pyc

windows10-2004-x64

res/mods/x...wf.pyc

windows7-x64

res/mods/x...wf.pyc

windows10-2004-x64

res/mods/x...fo.pyc

windows7-x64

res/mods/x...fo.pyc

windows10-2004-x64

res/mods/x...ew.pyc

windows7-x64

res/mods/x...ew.pyc

windows10-2004-x64

res/mods/x...t__.py

windows7-x64

res/mods/x...t__.py

windows10-2004-x64

res/mods/x...__.pyc

windows7-x64

res/mods/x...__.pyc

windows10-2004-x64

res/mods/x...er.exe

windows7-x64

res/mods/x...er.exe

windows10-2004-x64

res/mods/x...ad.dll

windows7-x64

res/mods/x...ad.dll

windows10-2004-x64

res/mods/x...rt.dll

windows7-x64

res/mods/x...rt.dll

windows10-2004-x64

res/mods/x...er.exe

windows7-x64

res/mods/x...er.exe

windows10-2004-x64

res/mods/x...ad.dll

windows7-x64

res/mods/x...ad.dll

windows10-2004-x64

res/mods/x...rt.dll

windows7-x64

res/mods/x...rt.dll

windows10-2004-x64

res/mods/x...__.pyc

windows7-x64

res/mods/x...__.pyc

windows10-2004-x64

res/mods/x...t__.py

windows7-x64

res/mods/x...t__.py

windows10-2004-x64

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 22:26

Sharing

Copy URL

Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

res/mods/xfw_packages/xfw_actionscript/__init__.py

Resource

win7-20240708-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

res/mods/xfw_packages/xfw_actionscript/__init__.py

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

res/mods/xfw_packages/xfw_actionscript/__init__.pyc

Resource

win7-20240708-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral4

Sample

res/mods/xfw_packages/xfw_actionscript/__init__.pyc

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

res/mods/xfw_packages/xfw_actionscript/python/__init__.pyc

Resource

win7-20240704-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral6

Sample

res/mods/xfw_packages/xfw_actionscript/python/__init__.pyc

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

res/mods/xfw_packages/xfw_actionscript/python/swf.pyc

Resource

win7-20240705-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral8

Sample

res/mods/xfw_packages/xfw_actionscript/python/swf.pyc

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

res/mods/xfw_packages/xfw_actionscript/python/swfloadedinfo.pyc

Resource

win7-20240708-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral10

Sample

res/mods/xfw_packages/xfw_actionscript/python/swfloadedinfo.pyc

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

res/mods/xfw_packages/xfw_actionscript/python/xfwview.pyc

Resource

win7-20240708-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral12

Sample

res/mods/xfw_packages/xfw_actionscript/python/xfwview.pyc

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

res/mods/xfw_packages/xfw_crashreport/__init__.py

Resource

win7-20240704-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral14

Sample

res/mods/xfw_packages/xfw_crashreport/__init__.py

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral15

Sample

res/mods/xfw_packages/xfw_crashreport/__init__.pyc

Resource

win7-20240708-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral16

Sample

res/mods/xfw_packages/xfw_crashreport/__init__.pyc

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

res/mods/xfw_packages/xfw_crashreport/native_32bit/crashpad_handler.exe

Resource

win7-20240704-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

res/mods/xfw_packages/xfw_crashreport/native_32bit/crashpad_handler.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

res/mods/xfw_packages/xfw_crashreport/native_32bit/sentry_crashpad.dll

Resource

win7-20240705-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

res/mods/xfw_packages/xfw_crashreport/native_32bit/sentry_crashpad.dll

Resource

win10v2004-20240704-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

res/mods/xfw_packages/xfw_crashreport/native_32bit/xfw_crashreport.dll

Resource

win7-20240704-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

res/mods/xfw_packages/xfw_crashreport/native_32bit/xfw_crashreport.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

res/mods/xfw_packages/xfw_crashreport/native_64bit/crashpad_handler.exe

Resource

win7-20240705-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

res/mods/xfw_packages/xfw_crashreport/native_64bit/crashpad_handler.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

res/mods/xfw_packages/xfw_crashreport/native_64bit/sentry_crashpad.dll

Resource

win7-20240704-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

res/mods/xfw_packages/xfw_crashreport/native_64bit/sentry_crashpad.dll

Resource

win10v2004-20240704-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

res/mods/xfw_packages/xfw_crashreport/native_64bit/xfw_crashreport.dll

Resource

win7-20240705-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

res/mods/xfw_packages/xfw_crashreport/native_64bit/xfw_crashreport.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

res/mods/xfw_packages/xfw_crashreport/python/__init__.pyc

Resource

win7-20240708-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral30

Sample

res/mods/xfw_packages/xfw_crashreport/python/__init__.pyc

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

res/mods/xfw_packages/xfw_filewatcher/__init__.py

Resource

win7-20240708-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral32

Sample

res/mods/xfw_packages/xfw_filewatcher/__init__.py

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

res/mods/xfw_packages/xfw_crashreport/native_32bit/xfw_crashreport.dll
Size

61KB
MD5

7c52f06a7e58e8fdcf19e78bdf60f5bb
SHA1

edbc7a00e17f51f88e8ee98244495bb3b617e6b3
SHA256

b8fb349a04c290b00e3fd3a4ec0533d06de132852fc1058c0d22ec42015eeb5d
SHA512

72fd130b65b233c6291988d7b35d6145e7f40691cfff806e577dec74034f2225e5b2e77cd31b82a45d49fcc9e10da778aa40a009311189a0f9518d54bf8c42ac
SSDEEP

768:VDdIlThYtcKVQZuTBM+lTBdEj91oiujOyk:Vp4YW0Bvl16/o9OP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\res\mods\xfw_packages\xfw_crashreport\native_32bit\xfw_crashreport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\res\mods\xfw_packages\xfw_crashreport\native_32bit\xfw_crashreport.dll,#1
  2⤵
  PID:2748

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads