Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 05:57
Static task
static1
Behavioral task
behavioral1
Sample
aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll
-
Size
6KB
-
MD5
aab046d8dab5bcbbcfd6821b45a27ea0
-
SHA1
9262970247eb4aaec6053f1bdb642670e9c412ba
-
SHA256
0b433b75525d175afe2d001402b4c4f84adfad228f44cf8851cd9062ddb5fe5c
-
SHA512
3d32aa76ebf5c838e7fcac60c2296375b4da07f4edf08814a34ba35aa25fb903dd63a4c379dd3fa3895c6a6a49ca137e97b48b1798858727b8b998383fd6aba9
-
SSDEEP
96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7bSLVI:juLJ/oAdQPQa2aeng7bSi
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2212 1692 rundll32.exe 28 PID 1692 wrote to memory of 2212 1692 rundll32.exe 28 PID 1692 wrote to memory of 2212 1692 rundll32.exe 28 PID 1692 wrote to memory of 2212 1692 rundll32.exe 28 PID 1692 wrote to memory of 2212 1692 rundll32.exe 28 PID 1692 wrote to memory of 2212 1692 rundll32.exe 28 PID 1692 wrote to memory of 2212 1692 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll,#12⤵PID:2212
-