Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
49774271826415b12bd06c192f42b380_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
49774271826415b12bd06c192f42b380_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
49774271826415b12bd06c192f42b380_NeikiAnalytics.exe
-
Size
976KB
-
MD5
49774271826415b12bd06c192f42b380
-
SHA1
25587ec423b4fd5aef87f5072567f6022f8564dd
-
SHA256
5395ffaed025949bd22a2d6a712826d1ca531636166caffe90d0a17bdcd4f4da
-
SHA512
4f305b4c833339c4d147fd7fa71342a5315a41186e8adca4d74b4c6dede5fc90d255933e086a264b2d3bebc6c5c973463015453a88d9233aa78338b18e7e5ba9
-
SSDEEP
12288:yDmmkvQOIvpbmlbqYfMG7km+rXHyOWEtggrKE+eJlmuzYjY5FRuu4IWO6:LTIvpbmUYfMG70/btggrrZHRd4s6
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2588 2912 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2588 2912 49774271826415b12bd06c192f42b380_NeikiAnalytics.exe 29 PID 2912 wrote to memory of 2588 2912 49774271826415b12bd06c192f42b380_NeikiAnalytics.exe 29 PID 2912 wrote to memory of 2588 2912 49774271826415b12bd06c192f42b380_NeikiAnalytics.exe 29 PID 2912 wrote to memory of 2588 2912 49774271826415b12bd06c192f42b380_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\49774271826415b12bd06c192f42b380_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\49774271826415b12bd06c192f42b380_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 522⤵
- Program crash
PID:2588
-