Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1887788f194f9f46727db3e9e1320d86_JaffaCakes118.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1887788f194f9f46727db3e9e1320d86_JaffaCakes118.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
1887788f194f9f46727db3e9e1320d86_JaffaCakes118.dll
-
Size
76KB
-
MD5
1887788f194f9f46727db3e9e1320d86
-
SHA1
c6b76aa6a7c661f4c2b92a087fb99a4fae3daec7
-
SHA256
e7b22777c92e01c77f63197871eaf8ec23c9c22e92cf84886e14134f0f3f1839
-
SHA512
7d739a9726de90f4320997e0ead984cd0c15ea090e6c0e0967fdcfe7a550fdfbfc832d585611af0ec8617e98e2d5874b5d88e64228c3aab466077d39b2f0ca07
-
SSDEEP
1536:QA8a2aMfMYmSqU5YxCSbLBmnNu/bfMVRBKdX:/dcMoqUS1LiuLMVRBKV
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1696 3020 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2356 wrote to memory of 3020 2356 rundll32.exe 28 PID 2356 wrote to memory of 3020 2356 rundll32.exe 28 PID 2356 wrote to memory of 3020 2356 rundll32.exe 28 PID 2356 wrote to memory of 3020 2356 rundll32.exe 28 PID 2356 wrote to memory of 3020 2356 rundll32.exe 28 PID 2356 wrote to memory of 3020 2356 rundll32.exe 28 PID 2356 wrote to memory of 3020 2356 rundll32.exe 28 PID 3020 wrote to memory of 1696 3020 rundll32.exe 29 PID 3020 wrote to memory of 1696 3020 rundll32.exe 29 PID 3020 wrote to memory of 1696 3020 rundll32.exe 29 PID 3020 wrote to memory of 1696 3020 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1887788f194f9f46727db3e9e1320d86_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1887788f194f9f46727db3e9e1320d86_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 2323⤵
- Program crash
PID:1696
-
-