Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 17:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll
Resource
win7-20240708-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll
-
Size
126KB
-
MD5
3a24f7925c13607f090b87661d038fff
-
SHA1
8144abc3e574b9c0387347ff1a54e97f5cd521f5
-
SHA256
eb87737df62fa325fd5d97e0bcc266ae240759ca180cbd22bdad3d98946e9b73
-
SHA512
3f0099f71287a5f4846b0f8867f463f09697220391a65ea89d6677493a401402cbbfb92286a58460286a14c6a9c9cf7e73e94f3e135796437f2f1506f556e0d7
-
SSDEEP
3072:P/GYCn9x2obI8t1ZVHR0lNnWVIRdYxSgK/:XGYC9xJIw1ZhOPnt0xSgK/
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 628 860 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 780 wrote to memory of 860 780 rundll32.exe 83 PID 780 wrote to memory of 860 780 rundll32.exe 83 PID 780 wrote to memory of 860 780 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll,#12⤵PID:860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 5723⤵
- Program crash
PID:628
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 860 -ip 8601⤵PID:3532