Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 02:31
Behavioral task
behavioral1
Sample
32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll
-
Size
5.3MB
-
MD5
32440723f96919753d9b0061d47ab3a5
-
SHA1
a2025df3f63011bf355d9714a67110dc4a07735d
-
SHA256
6beb4e9167cabd15b8c297fa65828fec7cd936fda8ee32f06e22b2ea6830fc4c
-
SHA512
d856ae58a0ce7b244d5d22b962e2cbcdd50de47ea115dbb65f296af86c242096121d743e2e5e2767c52d51963d11f868c21e3b59f6029a8f15dcf3df7a15f45d
-
SSDEEP
98304:fVvkMS8H9JFU7agDGj9mJqZX5YVPruU5emKEBQFXB8xP60+STv:Nv9S8H9JSNGj+c+PruU5eFXri
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2916 2884 rundll32.exe 84 PID 2884 wrote to memory of 2916 2884 rundll32.exe 84 PID 2884 wrote to memory of 2916 2884 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll,#12⤵PID:2916
-