Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 06:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24e0c75620994095b0aea7e307025609_JaffaCakes118.dll
Resource
win7-20240508-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
24e0c75620994095b0aea7e307025609_JaffaCakes118.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
24e0c75620994095b0aea7e307025609_JaffaCakes118.dll
-
Size
91KB
-
MD5
24e0c75620994095b0aea7e307025609
-
SHA1
568fc38629127be3d169dea746bf30ddd876b014
-
SHA256
c39eeaeaa309e28720bac200ee668b8a7230d16a1699f541ceac666e3de22498
-
SHA512
f3521651aaa0f2be7a968368b2c8a030b8667bbe916fe51996702212f4dca574b4ec23c6cf0a6670a218d8a383bba7455f3a44dd30cf179850488ebc37010940
-
SSDEEP
1536:KPmXQ3JawGfOcnJuWTiNz4BjucXr/jBV:OmmAwFWJusu0BNBV
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2928 1684 rundll32.exe 28 PID 1684 wrote to memory of 2928 1684 rundll32.exe 28 PID 1684 wrote to memory of 2928 1684 rundll32.exe 28 PID 1684 wrote to memory of 2928 1684 rundll32.exe 28 PID 1684 wrote to memory of 2928 1684 rundll32.exe 28 PID 1684 wrote to memory of 2928 1684 rundll32.exe 28 PID 1684 wrote to memory of 2928 1684 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24e0c75620994095b0aea7e307025609_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24e0c75620994095b0aea7e307025609_JaffaCakes118.dll,#12⤵PID:2928
-