Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2024, 06:56

General

  • Target

    27a2b61b89dafe2c01d1efcc2f4d834d_JaffaCakes118.dll

  • Size

    10KB

  • MD5

    27a2b61b89dafe2c01d1efcc2f4d834d

  • SHA1

    6d023ed1c022b76547f54987755cc03cda461722

  • SHA256

    85b0ba53940f70dbab3b210e7b22b9b7f939b83c1978b709518e99d7e09fe51b

  • SHA512

    190a7736bed8df14d15bc39778db02937446cf04a1b5fe8a2b93fd104b7fd0210035d21ebcf52fccdf32c0f5f4682a7fed444886b955723c8c40dd91aeaa0482

  • SSDEEP

    192:sQ7qvfH7UNiQBQuvyZrcccXhUZYZhMWzQ+ok:sIQHXOI5cccRUZKhRQ+o

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\27a2b61b89dafe2c01d1efcc2f4d834d_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\27a2b61b89dafe2c01d1efcc2f4d834d_JaffaCakes118.dll,#1
      2⤵
        PID:640
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 544
          3⤵
          • Program crash
          PID:4388
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 640 -ip 640
      1⤵
        PID:3444

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/640-0-0x0000000010000000-0x0000000010005000-memory.dmp

        Filesize

        20KB