Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 17:59
Static task
static1
Behavioral task
behavioral1
Sample
0f02b916530727976efbd52a000255d4_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0f02b916530727976efbd52a000255d4_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0f02b916530727976efbd52a000255d4_JaffaCakes118.dll
-
Size
737KB
-
MD5
0f02b916530727976efbd52a000255d4
-
SHA1
a55376d3d5e29092805b48741ecb73a4040ab6b3
-
SHA256
9870900d92c80afb088ba9bafdf96f55f16017adeb4b3cdbfd18d484288362fd
-
SHA512
2d65e034929f90b41641639503449731c231cdf9e2bb098cb584ab17ba19d30a770cc8af2319143e246a6aee8f43ae5cdadf19a2d129cb8aee4a68c1b1e692d8
-
SSDEEP
12288:Cu6iSe70DWSFAID02lbnkhF5dtSWD4t2F1sDw0P2NtCEodvWs6N7WSsoZJcw:Cu6iveW1ID0cDkhFftrD2xZMCEodvt6V
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1360 3116 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 380 wrote to memory of 3116 380 rundll32.exe 81 PID 380 wrote to memory of 3116 380 rundll32.exe 81 PID 380 wrote to memory of 3116 380 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f02b916530727976efbd52a000255d4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f02b916530727976efbd52a000255d4_JaffaCakes118.dll,#12⤵PID:3116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 5443⤵
- Program crash
PID:1360
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3116 -ip 31161⤵PID:4676