Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 22:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll
Resource
win7-20240419-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll
-
Size
1.6MB
-
MD5
0e29892787f2fc38005763ca5950c920
-
SHA1
a0bac45ac8b90530954dcdd51b483acf933e6b4b
-
SHA256
d1d44b94eba6eaebbce9d780dbc26170ed1c68e082a6e9b83556efc03947c880
-
SHA512
e1790f4528c71a12314bcf2f0cc63ef0efc8f096a96cc37839041d20c4f16b48451acf3367e1488d94cc90422bc6e667bf2196c85a16ccc9b2da42cdd671c0b9
-
SSDEEP
49152:hsPNbvGpw+s8KuqGaX0ToIBAUZLYBwnA:ilbvETJBAUZLI
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3740 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2136 wrote to memory of 3740 2136 rundll32.exe 83 PID 2136 wrote to memory of 3740 2136 rundll32.exe 83 PID 2136 wrote to memory of 3740 2136 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:3740
-