Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 09:33
Static task
static1
Behavioral task
behavioral1
Sample
70c75dbaf95026e6cbf6d6b366b31710_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
70c75dbaf95026e6cbf6d6b366b31710_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
70c75dbaf95026e6cbf6d6b366b31710_NeikiAnalytics.dll
-
Size
6KB
-
MD5
70c75dbaf95026e6cbf6d6b366b31710
-
SHA1
6638da0891eeaccdb0bed350fe62501215bd10ab
-
SHA256
373ed63598486d4e1d9f10364ad259f156e88294915c868c291aa59898ad82ad
-
SHA512
d947062a672b6cf977b418c4f6a22cb177a9b949efe29a6932f085345159e02c8a34a228ffd47985730d1901c831d53486e27f6a8cb4eacbf6e1d33efd2b389c
-
SSDEEP
48:6AA35YVOQDV8FszwydlAYsLFV3G0bzB+BDq9J5S2:0QDV8FscMjsLFV3vB+FqX5S2
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1236 wrote to memory of 4868 1236 rundll32.exe 81 PID 1236 wrote to memory of 4868 1236 rundll32.exe 81 PID 1236 wrote to memory of 4868 1236 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\70c75dbaf95026e6cbf6d6b366b31710_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\70c75dbaf95026e6cbf6d6b366b31710_NeikiAnalytics.dll,#12⤵PID:4868
-