0230243f0a9b8f0e20c987ad3f60d63bd755bb6a9a81684c605f2771bbb59129 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 12:10

Sharing

Report Analysis Logs

General

Target

31dc8311dd4abbe1e570c00136521480_NeikiAnalytics.dll
Size

6KB
MD5

31dc8311dd4abbe1e570c00136521480
SHA1

212e554b08fc24f381355d45747ef009e4bc3786
SHA256

0230243f0a9b8f0e20c987ad3f60d63bd755bb6a9a81684c605f2771bbb59129
SHA512

d55dda24e31f6f8b1bd5a396885a408e06a12e9326ade15dd4ca098a274ca7f43259563768006ff709e4ef630b2528dd8e7fdd958e91755a796412279978a0ed
SSDEEP

96:hy859x0P8MatG2NT1NwHEleTM5Ot4yHP2Om6:F5oLch1NEjInO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 1060	236	rundll32.exe	81
PID 236 wrote to memory of 1060	236	rundll32.exe	81
PID 236 wrote to memory of 1060	236	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31dc8311dd4abbe1e570c00136521480_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31dc8311dd4abbe1e570c00136521480_NeikiAnalytics.dll,#1
  2⤵
  PID:1060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads