Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
Resource
win7-20240215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
-
Size
107KB
-
MD5
77f881ce8a13393279aa4641e0fb1280
-
SHA1
70fda542679054b251b492f7286eb471cd21bc0f
-
SHA256
03324c52fb47356c6f8967b3c2b6208e9cde37e2ee5e13f496e9a0c58c6b217e
-
SHA512
1d570cc6ff8ac8ac9f8a466b7c6cb3e6f21b1043afdac1362bcdfaca9fd95719073408aabfde4191b58be0dc16629fa42a7cb83523b3ed16d85176a6daf8c4d7
-
SSDEEP
3072:REhLjKU6CnK4cT6HKBmg0crZA2fdmpmtEmfp:WjKucWvcri2fdK+
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1300 1712 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2620 wrote to memory of 1712 2620 regsvr32.exe 28 PID 2620 wrote to memory of 1712 2620 regsvr32.exe 28 PID 2620 wrote to memory of 1712 2620 regsvr32.exe 28 PID 2620 wrote to memory of 1712 2620 regsvr32.exe 28 PID 2620 wrote to memory of 1712 2620 regsvr32.exe 28 PID 2620 wrote to memory of 1712 2620 regsvr32.exe 28 PID 2620 wrote to memory of 1712 2620 regsvr32.exe 28 PID 1712 wrote to memory of 1300 1712 regsvr32.exe 29 PID 1712 wrote to memory of 1300 1712 regsvr32.exe 29 PID 1712 wrote to memory of 1300 1712 regsvr32.exe 29 PID 1712 wrote to memory of 1300 1712 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 2923⤵
- Program crash
PID:1300
-
-