Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
cc2acd8773ca746d1f2eda08bc14cd00_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cc2acd8773ca746d1f2eda08bc14cd00_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
cc2acd8773ca746d1f2eda08bc14cd00_NeikiAnalytics.dll
-
Size
81KB
-
MD5
cc2acd8773ca746d1f2eda08bc14cd00
-
SHA1
bad3a4f7b06c301f5f01988ac2da5d9c943111b3
-
SHA256
88b70cd53fdb8a8f423d8115a0e45fa25a2ce707770a46ec9608a7f71557bf1a
-
SHA512
bb080b7ce690bebd3e84c3d2310d3c97562c215a7a2b1508ded2f10e3abdb67f4ce26073e662358ad2899915197cebaa728bc8f628f5e9b4b2104868e1cd043b
-
SSDEEP
1536:7tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WO:74v4JKXTx71w0ArSsXF3enq8WO
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3896 wrote to memory of 740 3896 rundll32.exe 81 PID 3896 wrote to memory of 740 3896 rundll32.exe 81 PID 3896 wrote to memory of 740 3896 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cc2acd8773ca746d1f2eda08bc14cd00_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cc2acd8773ca746d1f2eda08bc14cd00_NeikiAnalytics.dll,#12⤵PID:740
-