Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
1ad4a910cdfc81667af99020d2029f40_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1ad4a910cdfc81667af99020d2029f40_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
General
-
Target
1ad4a910cdfc81667af99020d2029f40_NeikiAnalytics.dll
-
Size
5KB
-
MD5
1ad4a910cdfc81667af99020d2029f40
-
SHA1
aef3fbcbb90dd0d1378dd82d7e699f74ae769dd3
-
SHA256
c421357cf257090943e8fe47e369ea3cc5cc4dfaac2f342d6450b486568d2763
-
SHA512
ce1914f6b07f00784a351a9426c736bd9e468587d7ffe52623308964ed1f2e2bd0f5b47168b5c8d94b44757536b4400a4725de14788a2af3820b5ffd029517d4
-
SSDEEP
48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqk1njFPRFq1rsxYwv+/dsjfZVcVduXdnvQs:hy859x0P8Mak1hpEUMqjXc7gdYs
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2004 1868 rundll32.exe 28 PID 1868 wrote to memory of 2004 1868 rundll32.exe 28 PID 1868 wrote to memory of 2004 1868 rundll32.exe 28 PID 1868 wrote to memory of 2004 1868 rundll32.exe 28 PID 1868 wrote to memory of 2004 1868 rundll32.exe 28 PID 1868 wrote to memory of 2004 1868 rundll32.exe 28 PID 1868 wrote to memory of 2004 1868 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1ad4a910cdfc81667af99020d2029f40_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1ad4a910cdfc81667af99020d2029f40_NeikiAnalytics.dll,#12⤵PID:2004
-