Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1887788f194f9f46727db3e9e1320d86_JaffaCakes118.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1887788f194f9f46727db3e9e1320d86_JaffaCakes118.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
1887788f194f9f46727db3e9e1320d86_JaffaCakes118.dll
-
Size
76KB
-
MD5
1887788f194f9f46727db3e9e1320d86
-
SHA1
c6b76aa6a7c661f4c2b92a087fb99a4fae3daec7
-
SHA256
e7b22777c92e01c77f63197871eaf8ec23c9c22e92cf84886e14134f0f3f1839
-
SHA512
7d739a9726de90f4320997e0ead984cd0c15ea090e6c0e0967fdcfe7a550fdfbfc832d585611af0ec8617e98e2d5874b5d88e64228c3aab466077d39b2f0ca07
-
SSDEEP
1536:QA8a2aMfMYmSqU5YxCSbLBmnNu/bfMVRBKdX:/dcMoqUS1LiuLMVRBKV
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1220 4228 WerFault.exe 80 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4920 wrote to memory of 4228 4920 rundll32.exe 80 PID 4920 wrote to memory of 4228 4920 rundll32.exe 80 PID 4920 wrote to memory of 4228 4920 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1887788f194f9f46727db3e9e1320d86_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1887788f194f9f46727db3e9e1320d86_JaffaCakes118.dll,#12⤵PID:4228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 6283⤵
- Program crash
PID:1220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4228 -ip 42281⤵PID:4976