Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 07:10
Behavioral task
behavioral1
Sample
9b2ccd97ee0516afb926c09903de7e30_NeikiAnalytics.dll
Resource
win7-20240508-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b2ccd97ee0516afb926c09903de7e30_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
9b2ccd97ee0516afb926c09903de7e30_NeikiAnalytics.dll
-
Size
1.4MB
-
MD5
9b2ccd97ee0516afb926c09903de7e30
-
SHA1
9b07b55d946b635f78f9ccf5b3338a666f7072d0
-
SHA256
feb77b982c7db2c95dbd4da1175e5a368b2bde3bbe658651fbdb4dd5d75e994b
-
SHA512
9b5a58e46128c5cd92893d2c8c746494a6df679a53d5478f5bb9802c8f37b788f0ac4ed7b06f9f16658d68213d8da68334f063bac2be241d5a4f86fee19e123b
-
SSDEEP
24576:VL4G0WQaJd53sOC9cytrm4q3YyEo9yj2riFEN9hiIUwGMrPDp:Z4G0RSPcOCeytrmTpTrrzbPGKrp
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2972-1-0x0000000074EE0000-0x0000000075286000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2972 2956 rundll32.exe 28 PID 2956 wrote to memory of 2972 2956 rundll32.exe 28 PID 2956 wrote to memory of 2972 2956 rundll32.exe 28 PID 2956 wrote to memory of 2972 2956 rundll32.exe 28 PID 2956 wrote to memory of 2972 2956 rundll32.exe 28 PID 2956 wrote to memory of 2972 2956 rundll32.exe 28 PID 2956 wrote to memory of 2972 2956 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b2ccd97ee0516afb926c09903de7e30_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b2ccd97ee0516afb926c09903de7e30_NeikiAnalytics.dll,#12⤵PID:2972
-