Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 06:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27a2b61b89dafe2c01d1efcc2f4d834d_JaffaCakes118.dll
Resource
win7-20240705-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
27a2b61b89dafe2c01d1efcc2f4d834d_JaffaCakes118.dll
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
27a2b61b89dafe2c01d1efcc2f4d834d_JaffaCakes118.dll
-
Size
10KB
-
MD5
27a2b61b89dafe2c01d1efcc2f4d834d
-
SHA1
6d023ed1c022b76547f54987755cc03cda461722
-
SHA256
85b0ba53940f70dbab3b210e7b22b9b7f939b83c1978b709518e99d7e09fe51b
-
SHA512
190a7736bed8df14d15bc39778db02937446cf04a1b5fe8a2b93fd104b7fd0210035d21ebcf52fccdf32c0f5f4682a7fed444886b955723c8c40dd91aeaa0482
-
SSDEEP
192:sQ7qvfH7UNiQBQuvyZrcccXhUZYZhMWzQ+ok:sIQHXOI5cccRUZKhRQ+o
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4388 640 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1684 wrote to memory of 640 1684 rundll32.exe 82 PID 1684 wrote to memory of 640 1684 rundll32.exe 82 PID 1684 wrote to memory of 640 1684 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27a2b61b89dafe2c01d1efcc2f4d834d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27a2b61b89dafe2c01d1efcc2f4d834d_JaffaCakes118.dll,#12⤵PID:640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 5443⤵
- Program crash
PID:4388
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 640 -ip 6401⤵PID:3444