Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 09:59
Behavioral task
behavioral1
Sample
00846b2c00c7d457a455dde362a981b9_JaffaCakes118.dll
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
00846b2c00c7d457a455dde362a981b9_JaffaCakes118.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
00846b2c00c7d457a455dde362a981b9_JaffaCakes118.dll
-
Size
206KB
-
MD5
00846b2c00c7d457a455dde362a981b9
-
SHA1
7cdc93b940cb21595023af3ca778152c4037f6f7
-
SHA256
ac75ccb2251250b72ae69825909478d28cf9305be5db2bf3a474d6cb2e893669
-
SHA512
548f4acbe5d09693de7ed9d82acd3d776b4893cd0e1da915a0bcce126cc8f2584baec75fcf7a329043a854087f233ff9d66dfa692ac29ab1cdb55358c22e9c61
-
SSDEEP
3072:nryYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtZL5MuN:lXkiq4wfv4Kjnv+srwogV
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2084 2392 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2392 2244 rundll32.exe 28 PID 2244 wrote to memory of 2392 2244 rundll32.exe 28 PID 2244 wrote to memory of 2392 2244 rundll32.exe 28 PID 2244 wrote to memory of 2392 2244 rundll32.exe 28 PID 2244 wrote to memory of 2392 2244 rundll32.exe 28 PID 2244 wrote to memory of 2392 2244 rundll32.exe 28 PID 2244 wrote to memory of 2392 2244 rundll32.exe 28 PID 2392 wrote to memory of 2084 2392 rundll32.exe 29 PID 2392 wrote to memory of 2084 2392 rundll32.exe 29 PID 2392 wrote to memory of 2084 2392 rundll32.exe 29 PID 2392 wrote to memory of 2084 2392 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00846b2c00c7d457a455dde362a981b9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00846b2c00c7d457a455dde362a981b9_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 2403⤵
- Program crash
PID:2084
-
-