Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
1455edcace41bbb681b32e5c18ffd1d0_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1455edcace41bbb681b32e5c18ffd1d0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
1455edcace41bbb681b32e5c18ffd1d0_NeikiAnalytics.dll
-
Size
5KB
-
MD5
1455edcace41bbb681b32e5c18ffd1d0
-
SHA1
eea8feb96ba495190f0f176f9c4f6bdf3cce4bf1
-
SHA256
f373887486c99ee57854320ac308394174619e31fead459b41b4e87900a3517c
-
SHA512
434a2161f142aed8418fc23c5b881548cbaa9d5862e950efaa8ca8eb28119f5f806a0c16090113da89e91cf1ee2bba9a601feab8a4234496c08cf38dc32599f0
-
SSDEEP
48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHhjKGzhQ/jkdVBq+pv9t1W0jBEwXF:nEY2RrF1eqwi4ZPz+L8Vw8jjfn
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1616 wrote to memory of 2308 1616 rundll32.exe 29 PID 1616 wrote to memory of 2308 1616 rundll32.exe 29 PID 1616 wrote to memory of 2308 1616 rundll32.exe 29 PID 1616 wrote to memory of 2308 1616 rundll32.exe 29 PID 1616 wrote to memory of 2308 1616 rundll32.exe 29 PID 1616 wrote to memory of 2308 1616 rundll32.exe 29 PID 1616 wrote to memory of 2308 1616 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1455edcace41bbb681b32e5c18ffd1d0_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1455edcace41bbb681b32e5c18ffd1d0_NeikiAnalytics.dll,#12⤵PID:2308
-