Analysis
-
max time kernel
90s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 03:01
Static task
static1
Behavioral task
behavioral1
Sample
61afb625371660015e8997f967a3df00_NeikiAnalytics.dll
Resource
win7-20240220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
61afb625371660015e8997f967a3df00_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
61afb625371660015e8997f967a3df00_NeikiAnalytics.dll
-
Size
1.1MB
-
MD5
61afb625371660015e8997f967a3df00
-
SHA1
bb57303a97e841e13efe1c1c690fb0058c7c1a95
-
SHA256
8a637a9df4169655c25de985dda88817056ec5a6ed202ff119a11bce769789d7
-
SHA512
6d363138f2791319fd115136e01a84c2c7cf7a68e33b7cac2042372262e9866898040056adab31eb5a6a3579d6aa769560c0129967ab70d9962c873f477e738d
-
SSDEEP
24576:9RmTfm3BiDnRWyUtjjsAT4gEcqXrwmQ4r/RnnuTYZcJfw5XrEH7f:aTeQDRWyUtjjiEn4rxuTQcJf4C
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4004 wrote to memory of 5100 4004 rundll32.exe 81 PID 4004 wrote to memory of 5100 4004 rundll32.exe 81 PID 4004 wrote to memory of 5100 4004 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61afb625371660015e8997f967a3df00_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61afb625371660015e8997f967a3df00_NeikiAnalytics.dll,#12⤵PID:5100
-