Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 01:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe
Resource
win7-20240419-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe
-
Size
107KB
-
MD5
5ee5d7b3633e51e4feaa1916cd141d60
-
SHA1
ea20d82c6f15c820f7fd8c27e4122da26ee20e91
-
SHA256
ade81baef4926f4fb98ad5589bc5aafd466a90ff3ac9b0f6a40130b1571a75bd
-
SHA512
7a5daf1d1e2cebe06e2720442c520531d7466ee458c56c6b7e040e67065a129b0b676ca936e47cf81a98f43126b4535779d864c39fd5fef7b0709198637d6f18
-
SSDEEP
3072:REhLjKF6CnK4cT6HKBmg0crXz2fdmpmtzufp:WjK/cWvcrj2fdKZ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2100 2096 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2096 1968 regsvr32.exe 28 PID 1968 wrote to memory of 2096 1968 regsvr32.exe 28 PID 1968 wrote to memory of 2096 1968 regsvr32.exe 28 PID 1968 wrote to memory of 2096 1968 regsvr32.exe 28 PID 1968 wrote to memory of 2096 1968 regsvr32.exe 28 PID 1968 wrote to memory of 2096 1968 regsvr32.exe 28 PID 1968 wrote to memory of 2096 1968 regsvr32.exe 28 PID 2096 wrote to memory of 2100 2096 regsvr32.exe 29 PID 2096 wrote to memory of 2100 2096 regsvr32.exe 29 PID 2096 wrote to memory of 2100 2096 regsvr32.exe 29 PID 2096 wrote to memory of 2100 2096 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 2923⤵
- Program crash
PID:2100
-
-