Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 16:50
Behavioral task
behavioral1
Sample
35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll
Resource
win7-20240708-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll
-
Size
79KB
-
MD5
35916dea658143808d51d1f0d473b22b
-
SHA1
9c6602fbcf6dd16d3c93f6ee7fac36890ab45139
-
SHA256
b4fcdc55ff536a871110cf00420fcfa313df8715db7f4d7c217a2bf169af1ebf
-
SHA512
fbfd795ba262d2ccbc8d584fb796dcdee20756cf1c7d051484303747b9ccddb71968287b00062309af13db03a07124c38ca1fdf9b241d217db4198372df48ae5
-
SSDEEP
1536:n1P3M7oe6wdFD64eAMtvrs5BcD4FTYYuG+EkTt9kL+t8uF2d:n107D6EDVWvrs5S0iYz+vt9NtQ
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2504 2084 rundll32.exe 30 PID 2084 wrote to memory of 2504 2084 rundll32.exe 30 PID 2084 wrote to memory of 2504 2084 rundll32.exe 30 PID 2084 wrote to memory of 2504 2084 rundll32.exe 30 PID 2084 wrote to memory of 2504 2084 rundll32.exe 30 PID 2084 wrote to memory of 2504 2084 rundll32.exe 30 PID 2084 wrote to memory of 2504 2084 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll,#12⤵PID:2504
-