Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 05:57
Static task
static1
Behavioral task
behavioral1
Sample
aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll
-
Size
6KB
-
MD5
aab046d8dab5bcbbcfd6821b45a27ea0
-
SHA1
9262970247eb4aaec6053f1bdb642670e9c412ba
-
SHA256
0b433b75525d175afe2d001402b4c4f84adfad228f44cf8851cd9062ddb5fe5c
-
SHA512
3d32aa76ebf5c838e7fcac60c2296375b4da07f4edf08814a34ba35aa25fb903dd63a4c379dd3fa3895c6a6a49ca137e97b48b1798858727b8b998383fd6aba9
-
SSDEEP
96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7bSLVI:juLJ/oAdQPQa2aeng7bSi
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3644 wrote to memory of 3884 3644 rundll32.exe 82 PID 3644 wrote to memory of 3884 3644 rundll32.exe 82 PID 3644 wrote to memory of 3884 3644 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll,#12⤵PID:3884
-