Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 20:08
Behavioral task
behavioral1
Sample
649f64b0dbf2229b8ee7ac340bc52bc0_JaffaCakes118.dll
Resource
win7-20240708-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
649f64b0dbf2229b8ee7ac340bc52bc0_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
649f64b0dbf2229b8ee7ac340bc52bc0_JaffaCakes118.dll
-
Size
63KB
-
MD5
649f64b0dbf2229b8ee7ac340bc52bc0
-
SHA1
084759108e67f297974fa8d15a96b8370d3cc84e
-
SHA256
cdb6377b6c498f4bd8962a20573d66c08ef3137fc83923f09440b3a619cc7db2
-
SHA512
877c26c0d5fb444b81d8999ff3ac81f0bc51fcc1e8e8e6f22982edf64f9d9f7a3a0e56366b73169fa6d28b3fc91ab6d51b356c9f6078755b7f71c9ec4e92872b
-
SSDEEP
1536:agF0eiyUcb8SUbNAO1jSBXTY46Aq994/FAH:t2yFbjr6T9mFq
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1044-0-0x0000000010000000-0x0000000010011000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2176 wrote to memory of 1044 2176 rundll32.exe 84 PID 2176 wrote to memory of 1044 2176 rundll32.exe 84 PID 2176 wrote to memory of 1044 2176 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\649f64b0dbf2229b8ee7ac340bc52bc0_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\649f64b0dbf2229b8ee7ac340bc52bc0_JaffaCakes118.dll,#12⤵PID:1044
-