Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
b9349d32f21c747e1fe87202fa8fdc30_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b9349d32f21c747e1fe87202fa8fdc30_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
b9349d32f21c747e1fe87202fa8fdc30_NeikiAnalytics.dll
-
Size
5KB
-
MD5
b9349d32f21c747e1fe87202fa8fdc30
-
SHA1
81456ef3e8f85ed2375649a87fc5d7e6f1c763b8
-
SHA256
841a5607397c55190ea876df0f5e964bf925be4f0bd589e6421c7695c2cf3ce7
-
SHA512
d30cecc6df46cfbc0ccea0ae4443c44c130ca2c8888d2540dae6af7dfb3f3030c1a993901afd327e4aa8886402cacfde8e94efd70c71c6ac764267b3ac9d5019
-
SSDEEP
96:DixZjmjtjd8jPjcZGR5TIeo4xBCldLLGh0iLPzilDDx:unSR6bgYY4CnY/Dz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1940 wrote to memory of 4968 1940 rundll32.exe 82 PID 1940 wrote to memory of 4968 1940 rundll32.exe 82 PID 1940 wrote to memory of 4968 1940 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9349d32f21c747e1fe87202fa8fdc30_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9349d32f21c747e1fe87202fa8fdc30_NeikiAnalytics.dll,#12⤵PID:4968
-