Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
0s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 11:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f35b2e0ba915cfeccb657e3c6f98a8ba_JaffaCakes118.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
f35b2e0ba915cfeccb657e3c6f98a8ba_JaffaCakes118.dll
Resource
win10v2004-20240412-en
9 signatures
150 seconds
General
-
Target
f35b2e0ba915cfeccb657e3c6f98a8ba_JaffaCakes118.dll
-
Size
25KB
-
MD5
f35b2e0ba915cfeccb657e3c6f98a8ba
-
SHA1
0fd86f52ac93d56591f479e96645caec2716c10d
-
SHA256
e09dd0cc3b7b26a2286957fe70e8cbf09f7d80a7b4fc6cec2ea966e20e5611bf
-
SHA512
608e794091a29069a2a2b46940007bb73926d5f05c346fbc8d333ede02b135555dd7d895a358a2cdb957655dc94a145094c5fbd3232b54e9838db49f4bed2e21
-
SSDEEP
768:uYgQlevpDiSK6pX9B6U9E0G6xEpYHFSFq:lleh9KWHVKJFq
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2656 2028 rundll32.exe 28 PID 2028 wrote to memory of 2656 2028 rundll32.exe 28 PID 2028 wrote to memory of 2656 2028 rundll32.exe 28 PID 2028 wrote to memory of 2656 2028 rundll32.exe 28 PID 2028 wrote to memory of 2656 2028 rundll32.exe 28 PID 2028 wrote to memory of 2656 2028 rundll32.exe 28 PID 2028 wrote to memory of 2656 2028 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f35b2e0ba915cfeccb657e3c6f98a8ba_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f35b2e0ba915cfeccb657e3c6f98a8ba_JaffaCakes118.dll,#12⤵PID:2656
-