8ec46ac505477ba8cc5d73f2b861582d47668c34794de71d14596c903a0c86d2 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 16:24

Sharing

Report Analysis Logs

General

Target

2d656da826349e5e42cd3a0dd22dc590_NeikiAnalytics.dll
Size

2.0MB
MD5

2d656da826349e5e42cd3a0dd22dc590
SHA1

a39df7abd28ec119357e4fcf7651291d4276edce
SHA256

8ec46ac505477ba8cc5d73f2b861582d47668c34794de71d14596c903a0c86d2
SHA512

244dce177d58dafc41eefc61eb87d6933b514ad0668475340743fd4d5c620468db8320d7f218b3b6e4d5cd5d4bd35af697a36121a98746d141bab1f3ba28bc74
SSDEEP

49152:znbShmTlytFhhljvdSZ4/GS7/VkaP07+Pz:zbUmTdWG02

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 4148	2720	rundll32.exe	82
PID 2720 wrote to memory of 4148	2720	rundll32.exe	82
PID 2720 wrote to memory of 4148	2720	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d656da826349e5e42cd3a0dd22dc590_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d656da826349e5e42cd3a0dd22dc590_NeikiAnalytics.dll,#1
  2⤵
  PID:4148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads