Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 22:25
Behavioral task
behavioral1
Sample
43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll
Resource
win7-20240708-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll
-
Size
85KB
-
MD5
43953c2b85cf6937c5bc1d5e06635efe
-
SHA1
ee7780df25d8f5f0527d2e20d07f83058b545a3b
-
SHA256
7c97734988b98e9135c045a1e8c03d7e4ca7bb4fbc1cb8ab00a4a116eb05d8d1
-
SHA512
cedec80e63bf5152cf65060da08cb95306d6421a172e7ad103b64c717c60c74fcda4e189b40127be1ef215ad8e43fc94c71adf341a788aa1ec269ddd8948beb7
-
SSDEEP
1536:nw0yKsoJxGqtBehZQywvoUvCG5om1skUjbCS1FQlhzEomL:RHJXBAQyg5okbyV1uvrU
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1736 wrote to memory of 808 1736 rundll32.exe 30 PID 1736 wrote to memory of 808 1736 rundll32.exe 30 PID 1736 wrote to memory of 808 1736 rundll32.exe 30 PID 1736 wrote to memory of 808 1736 rundll32.exe 30 PID 1736 wrote to memory of 808 1736 rundll32.exe 30 PID 1736 wrote to memory of 808 1736 rundll32.exe 30 PID 1736 wrote to memory of 808 1736 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll,#12⤵PID:808
-