Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 06:50
Static task
static1
Behavioral task
behavioral1
Sample
b56f38b7a96296af0200c5358c7564c0_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b56f38b7a96296af0200c5358c7564c0_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
General
-
Target
b56f38b7a96296af0200c5358c7564c0_NeikiAnalytics.dll
-
Size
1.4MB
-
MD5
b56f38b7a96296af0200c5358c7564c0
-
SHA1
978b46f53a6c6944f9173273dc18d4c71905c7d0
-
SHA256
109b69348c18c5034ae45e79f5807ff629ab53362ad67bc2de5394160d00f7a7
-
SHA512
86516fbcab1ee0bc9bddde3c6e77c52a17afd066bd55764dc9fac7ff4eec863b2094f03aba7f153520766a0609bce0f152617f8a1898ef6bfae22ff65905eacb
-
SSDEEP
24576:KjfkQQydfuZ8qccJr5KegkCWk6xTq5cfB0EyeuO761KfRV3b:UQydfuZtccN5xxMczya768fRtb
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b56f38b7a96296af0200c5358c7564c0_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b56f38b7a96296af0200c5358c7564c0_NeikiAnalytics.dll,#12⤵PID:2992
-