Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
2e97d0c109e4a04a9116a0fe3a7027dc6adff579e9b6312f696e3b708f5a1bc4_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2e97d0c109e4a04a9116a0fe3a7027dc6adff579e9b6312f696e3b708f5a1bc4_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
2e97d0c109e4a04a9116a0fe3a7027dc6adff579e9b6312f696e3b708f5a1bc4_NeikiAnalytics.dll
-
Size
7KB
-
MD5
cc287a82b9fcb00d596d45c6c3fc21f0
-
SHA1
b3a96184e3cf9b2245ef6571914a3c2cd8e8f6d2
-
SHA256
2e97d0c109e4a04a9116a0fe3a7027dc6adff579e9b6312f696e3b708f5a1bc4
-
SHA512
6d37a93c6e7da05d1b9fc1198f3bddfbdd2848a83a8c633da9ebf055b9a51a91bbba5fb055d397c39ef2ad21f5ef1036583043f92cc8dd0cfa9a79eb1cfdf63d
-
SSDEEP
48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWdbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPDq3qX5S2hV
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4288 wrote to memory of 2100 4288 rundll32.exe 82 PID 4288 wrote to memory of 2100 4288 rundll32.exe 82 PID 4288 wrote to memory of 2100 4288 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e97d0c109e4a04a9116a0fe3a7027dc6adff579e9b6312f696e3b708f5a1bc4_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e97d0c109e4a04a9116a0fe3a7027dc6adff579e9b6312f696e3b708f5a1bc4_NeikiAnalytics.dll,#12⤵PID:2100
-