a40307fdefcdd74446bd075cb4b5e745b40e9ca171bfdfc473e58e029c07015a | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 01:25

Sharing

Report Analysis Logs

General

Target

3b454161e9500ab4ed1dd2d5215d53a0_NeikiAnalytics.dll
Size

3KB
MD5

3b454161e9500ab4ed1dd2d5215d53a0
SHA1

8f3b74f3d58835fdc011e6abcf79fbf89f246e9f
SHA256

a40307fdefcdd74446bd075cb4b5e745b40e9ca171bfdfc473e58e029c07015a
SHA512

a83cb0843d7ccabe193bc5c00cc981a4efad59598aad2884e2e52d6e9fa46fa6cdcbf030d2b93fc887efeaa494bb2b1bee7873f4bda7494b6e3162bf243ec884

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1952	1984	rundll32.exe	28
PID 1984 wrote to memory of 1952	1984	rundll32.exe	28
PID 1984 wrote to memory of 1952	1984	rundll32.exe	28
PID 1984 wrote to memory of 1952	1984	rundll32.exe	28
PID 1984 wrote to memory of 1952	1984	rundll32.exe	28
PID 1984 wrote to memory of 1952	1984	rundll32.exe	28
PID 1984 wrote to memory of 1952	1984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b454161e9500ab4ed1dd2d5215d53a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b454161e9500ab4ed1dd2d5215d53a0_NeikiAnalytics.dll,#1
  2⤵
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads