Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
9dfcb9dacc7c3f58cb5f52f83fb613a2ed9ed8c5691f11056fd0f37e51583364_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9dfcb9dacc7c3f58cb5f52f83fb613a2ed9ed8c5691f11056fd0f37e51583364_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
9dfcb9dacc7c3f58cb5f52f83fb613a2ed9ed8c5691f11056fd0f37e51583364_NeikiAnalytics.dll
-
Size
94KB
-
MD5
bdfbbda01f370527f6e6a0bd497bb530
-
SHA1
ab25ebff2333c21a194a93c3f7888c2d399594bb
-
SHA256
9dfcb9dacc7c3f58cb5f52f83fb613a2ed9ed8c5691f11056fd0f37e51583364
-
SHA512
ad04b1251963678dd7a3ab8660066b018194c65ecafda6fd98bb4ab5f8424d91ddd9c9f3b8797b71b222b1ccbcf2be4c4e4b61e17bae29de38638d41328fadc9
-
SSDEEP
1536:gUuG/ChRBPpDZstRbN+XuGhEJta54aXVI9Pfxqrp+Chi7PCDlX9nGIuME0wh4m:gpG/ChRBBDZKRbQXuXJAV6PfxSp+Chi3
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2924 2256 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 116 wrote to memory of 2256 116 rundll32.exe 83 PID 116 wrote to memory of 2256 116 rundll32.exe 83 PID 116 wrote to memory of 2256 116 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9dfcb9dacc7c3f58cb5f52f83fb613a2ed9ed8c5691f11056fd0f37e51583364_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9dfcb9dacc7c3f58cb5f52f83fb613a2ed9ed8c5691f11056fd0f37e51583364_NeikiAnalytics.dll,#12⤵PID:2256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 5443⤵
- Program crash
PID:2924
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2256 -ip 22561⤵PID:2104