Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 21:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll
Resource
win7-20240705-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll
-
Size
861KB
-
MD5
3ef79824f34e8195c64f57affee25c46
-
SHA1
f2be2e070dd522102840767589408400a603f0a5
-
SHA256
976ceae5566c5f77b4d440229d13dc10fe94ec86cfcf6fe4ecc01aad9e4a6aed
-
SHA512
9adc24b01875c3458d00b473bc77a599fb4895a4c523c3f728be03e3a199128198f295e165fe1d28427de760de4307716050e06ae92b17bd6f40f547947ed8ca
-
SSDEEP
24576:feVyyucjuKybpZufCwT+Pr7URqnfhDnEnO01hE:GlYpEf7q5fZEnO
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1108 wrote to memory of 2072 1108 rundll32.exe 30 PID 1108 wrote to memory of 2072 1108 rundll32.exe 30 PID 1108 wrote to memory of 2072 1108 rundll32.exe 30 PID 1108 wrote to memory of 2072 1108 rundll32.exe 30 PID 1108 wrote to memory of 2072 1108 rundll32.exe 30 PID 1108 wrote to memory of 2072 1108 rundll32.exe 30 PID 1108 wrote to memory of 2072 1108 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll,#12⤵PID:2072
-