Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
Launcher.bat
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Launcher.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
compiler.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
compiler.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
lua51.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
lua51.dll
Resource
win10v2004-20240709-en
General
-
Target
lua51.dll
-
Size
389KB
-
MD5
fb2b8675cf63baddf4430bf7f53ff218
-
SHA1
502b193ec72eb71192f6b783cffe9b6eb8bc944a
-
SHA256
16c4d10cb496578b0ca63c0c30e1e346cf3f879326768889386c058760f9a39e
-
SHA512
41a1183a87b6879add36de49cc876e07dcc365289ebc4359ca836bc9376fef10bedde7e2c878be238315296d20780c06e7305d913757b6879e86051439348892
-
SSDEEP
12288:siZ+ox9piQ8G27pC6Yyu5t60O0MJuAghAuNwABU:se19pm7pCuCt6+w
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4324 4704 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4544 wrote to memory of 4704 4544 rundll32.exe 83 PID 4544 wrote to memory of 4704 4544 rundll32.exe 83 PID 4544 wrote to memory of 4704 4544 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lua51.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lua51.dll,#12⤵PID:4704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 6043⤵
- Program crash
PID:4324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4704 -ip 47041⤵PID:3900