Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 11:43
Behavioral task
behavioral1
Sample
2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll
Resource
win7-20240704-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll
-
Size
102KB
-
MD5
2c35b1c1fe5de16ca56aa1895b9f9cb0
-
SHA1
ea1f5136b900c6f73eb1a7f5f0ff9af549f84aec
-
SHA256
ed92f50e63da06ba1cb705afd1117f6c25bccadbfdc203ecf733e3f33cb52d68
-
SHA512
a73b55aecdc3374c6240b20b0669e7d883e4bbfaafbd2de624ecb47aafdf033fc04f5f4b03c00cca4c5e8ef3b17812bdcb22f20fd9cc48f0dfae5b7a1651766b
-
SSDEEP
3072:7RCVcAHzYRjDfgVYIzfoHOJFykZdHUSVVaRKeR8W:7syzR/8eOekbHPURQW
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4684-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3296 wrote to memory of 4684 3296 rundll32.exe 82 PID 3296 wrote to memory of 4684 3296 rundll32.exe 82 PID 3296 wrote to memory of 4684 3296 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll,#12⤵PID:4684
-