Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 09:59
Behavioral task
behavioral1
Sample
00846b2c00c7d457a455dde362a981b9_JaffaCakes118.dll
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
00846b2c00c7d457a455dde362a981b9_JaffaCakes118.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
00846b2c00c7d457a455dde362a981b9_JaffaCakes118.dll
-
Size
206KB
-
MD5
00846b2c00c7d457a455dde362a981b9
-
SHA1
7cdc93b940cb21595023af3ca778152c4037f6f7
-
SHA256
ac75ccb2251250b72ae69825909478d28cf9305be5db2bf3a474d6cb2e893669
-
SHA512
548f4acbe5d09693de7ed9d82acd3d776b4893cd0e1da915a0bcce126cc8f2584baec75fcf7a329043a854087f233ff9d66dfa692ac29ab1cdb55358c22e9c61
-
SSDEEP
3072:nryYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtZL5MuN:lXkiq4wfv4Kjnv+srwogV
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4988 1900 WerFault.exe 86 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4532 wrote to memory of 1900 4532 rundll32.exe 86 PID 4532 wrote to memory of 1900 4532 rundll32.exe 86 PID 4532 wrote to memory of 1900 4532 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00846b2c00c7d457a455dde362a981b9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00846b2c00c7d457a455dde362a981b9_JaffaCakes118.dll,#12⤵PID:1900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 6803⤵
- Program crash
PID:4988
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1900 -ip 19001⤵PID:3224