Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 03:41
Behavioral task
behavioral1
Sample
400d86e561e3a78b2c2ee65cb41c55c2_JaffaCakes118.dll
Resource
win7-20240705-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
400d86e561e3a78b2c2ee65cb41c55c2_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
400d86e561e3a78b2c2ee65cb41c55c2_JaffaCakes118.dll
-
Size
131KB
-
MD5
400d86e561e3a78b2c2ee65cb41c55c2
-
SHA1
57faa5435418a226580a1562cf6292a7137bdc47
-
SHA256
1c5ab8b5b1aa4b95d713ee7fd8244ec1ce3825914700337319b25f830f2a5a50
-
SHA512
fc4a951b95e31895a503ad21ace119e1767ee27302da190ee9ebe8acb8d247fb4f86d6df1a0c9f2a4f01a5cb39c4e1ac6ee22e0dcbc3cdd8729c0aa2dd464a08
-
SSDEEP
1536:6Rw9k6k1FrHc5IFP9VzVmIg+qJSP3q7rR4IfhDHn9A1:/cHr8WnmIBqJSP3k91HW1
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1820 wrote to memory of 904 1820 rundll32.exe 30 PID 1820 wrote to memory of 904 1820 rundll32.exe 30 PID 1820 wrote to memory of 904 1820 rundll32.exe 30 PID 1820 wrote to memory of 904 1820 rundll32.exe 30 PID 1820 wrote to memory of 904 1820 rundll32.exe 30 PID 1820 wrote to memory of 904 1820 rundll32.exe 30 PID 1820 wrote to memory of 904 1820 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\400d86e561e3a78b2c2ee65cb41c55c2_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\400d86e561e3a78b2c2ee65cb41c55c2_JaffaCakes118.dll,#12⤵PID:904
-