1eccca4bc736a55d8f9d718e6adb2b6e54261a401bf6ca66a8f8213c4ab32fda | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 07:20

Sharing

Report Analysis Logs

General

Target

9d3f73a375e1fb8f39a4d5f9fd020c50_NeikiAnalytics.dll
Size

3KB
MD5

9d3f73a375e1fb8f39a4d5f9fd020c50
SHA1

75818b1bec1bfd00be3c63eb6bbabf5e7f8e88d7
SHA256

1eccca4bc736a55d8f9d718e6adb2b6e54261a401bf6ca66a8f8213c4ab32fda
SHA512

c0be4e95c1665f3b58b80e13ed23f3709b34e524269be21f1105db9e53ead5581d8dc3145f9df534c832610789ee5a297f1885977a015740603166e8bbba7749

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d3f73a375e1fb8f39a4d5f9fd020c50_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d3f73a375e1fb8f39a4d5f9fd020c50_NeikiAnalytics.dll,#1
  2⤵
  PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads