Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 22:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
266ae4c931b94961aa496438010d5944_JaffaCakes118.dll
Resource
win7-20240419-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
266ae4c931b94961aa496438010d5944_JaffaCakes118.dll
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
266ae4c931b94961aa496438010d5944_JaffaCakes118.dll
-
Size
30KB
-
MD5
266ae4c931b94961aa496438010d5944
-
SHA1
e3c90f8e737fa6b6af180a4eb8781d9953ec82cf
-
SHA256
e54b2b88b75a6d1e11e73efb83ec381a39509a41b2fb8b4875b35557382c70df
-
SHA512
8ff2513083bf28dd5d7d60bc134251d65cb3e65be344f11f71424cca46d42b6f0f470de516eef7e5921d2f956ca6d79082e9c4d4b8e93bc9f25d32a7935f8213
-
SSDEEP
768:bjGMWflD3dH8nrlA8Xdg0YBd00dpqlzTSk9:bjGhNDNH6hj2Rd0GpqxSk
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2468 wrote to memory of 1864 2468 rundll32.exe 28 PID 2468 wrote to memory of 1864 2468 rundll32.exe 28 PID 2468 wrote to memory of 1864 2468 rundll32.exe 28 PID 2468 wrote to memory of 1864 2468 rundll32.exe 28 PID 2468 wrote to memory of 1864 2468 rundll32.exe 28 PID 2468 wrote to memory of 1864 2468 rundll32.exe 28 PID 2468 wrote to memory of 1864 2468 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\266ae4c931b94961aa496438010d5944_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\266ae4c931b94961aa496438010d5944_JaffaCakes118.dll,#12⤵PID:1864
-