Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 02:31
Behavioral task
behavioral1
Sample
32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll
-
Size
5.3MB
-
MD5
32440723f96919753d9b0061d47ab3a5
-
SHA1
a2025df3f63011bf355d9714a67110dc4a07735d
-
SHA256
6beb4e9167cabd15b8c297fa65828fec7cd936fda8ee32f06e22b2ea6830fc4c
-
SHA512
d856ae58a0ce7b244d5d22b962e2cbcdd50de47ea115dbb65f296af86c242096121d743e2e5e2767c52d51963d11f868c21e3b59f6029a8f15dcf3df7a15f45d
-
SSDEEP
98304:fVvkMS8H9JFU7agDGj9mJqZX5YVPruU5emKEBQFXB8xP60+STv:Nv9S8H9JSNGj+c+PruU5eFXri
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2952 2888 rundll32.exe 28 PID 2888 wrote to memory of 2952 2888 rundll32.exe 28 PID 2888 wrote to memory of 2952 2888 rundll32.exe 28 PID 2888 wrote to memory of 2952 2888 rundll32.exe 28 PID 2888 wrote to memory of 2952 2888 rundll32.exe 28 PID 2888 wrote to memory of 2952 2888 rundll32.exe 28 PID 2888 wrote to memory of 2952 2888 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll,#12⤵PID:2952
-