Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2024, 13:47 UTC

General

  • Target

    libGLESv2.dll

  • Size

    5.2MB

  • MD5

    69cb9035012b445752f366fdbcdc1330

  • SHA1

    17e15f77b6b51d3a8ba0d8ef4c44f74952ac4000

  • SHA256

    42b4d924e94fca04094f7b9fe318a726c33001e7d4dc4313e3655f68ee714023

  • SHA512

    dde200611d8fa2bd99b128854258ef371723d1854396d8b6fb8b976c77643b17d1fa07da72ea68695c04e5babd6fb38baa8ad8abd6fb452855b9156c5de6cb98

  • SSDEEP

    98304:WyHvU6gTY6Y9zIreEkjvTDIEsBwBdu/mCVUYh2dOQu2pfMpZw3:WyHF8hYZIrepIEsQkWYh2dlp

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 220
        3⤵
        • Program crash
        PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.