Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 17:27
Static task
static1
Behavioral task
behavioral1
Sample
21bccec31dd0892a6ed97ec3a0b6b5b0_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21bccec31dd0892a6ed97ec3a0b6b5b0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
21bccec31dd0892a6ed97ec3a0b6b5b0_NeikiAnalytics.dll
-
Size
5KB
-
MD5
21bccec31dd0892a6ed97ec3a0b6b5b0
-
SHA1
2959f6251c00a50c89e42f4b8af71107fa770b97
-
SHA256
a6cf7ca2ba403d905a56e26639fd5929e55afd22db015a46338ccbb1eea9ea96
-
SHA512
9e2844c100ff4eb5ada1cb38c42108f295610bc718b2e6458af58d504c08e68a17d94a3e16f5f6e970d122a590a6db985821e217ba2070d0a648d35e261e389a
-
SSDEEP
96:hy859x0P8MaGDWYqpevu9p/ZgSz4x2QTb3cYNI4:F5oLbDXqc29bg5x2QXcY
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3744 wrote to memory of 1816 3744 rundll32.exe 82 PID 3744 wrote to memory of 1816 3744 rundll32.exe 82 PID 3744 wrote to memory of 1816 3744 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21bccec31dd0892a6ed97ec3a0b6b5b0_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21bccec31dd0892a6ed97ec3a0b6b5b0_NeikiAnalytics.dll,#12⤵PID:1816
-