Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
Resource
win7-20240215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
-
Size
107KB
-
MD5
77f881ce8a13393279aa4641e0fb1280
-
SHA1
70fda542679054b251b492f7286eb471cd21bc0f
-
SHA256
03324c52fb47356c6f8967b3c2b6208e9cde37e2ee5e13f496e9a0c58c6b217e
-
SHA512
1d570cc6ff8ac8ac9f8a466b7c6cb3e6f21b1043afdac1362bcdfaca9fd95719073408aabfde4191b58be0dc16629fa42a7cb83523b3ed16d85176a6daf8c4d7
-
SSDEEP
3072:REhLjKU6CnK4cT6HKBmg0crZA2fdmpmtEmfp:WjKucWvcri2fdK+
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1164 3308 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 680 wrote to memory of 3308 680 regsvr32.exe 82 PID 680 wrote to memory of 3308 680 regsvr32.exe 82 PID 680 wrote to memory of 3308 680 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe1⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe2⤵PID:3308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 6003⤵
- Program crash
PID:1164
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3308 -ip 33081⤵PID:2512