Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 21:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fb3e342d03db4eb325fa35949dac380_NeikiAnalytics.dll
Resource
win7-20240508-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3fb3e342d03db4eb325fa35949dac380_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
3fb3e342d03db4eb325fa35949dac380_NeikiAnalytics.dll
-
Size
468KB
-
MD5
3fb3e342d03db4eb325fa35949dac380
-
SHA1
77bc1cae9d47a750849854bfdf7fa76c224f7353
-
SHA256
ce098ceb0fb422b623eb38816d8feded48b429ac8f941a3de4ab41142e337381
-
SHA512
373a804a3458483b6ff036c7bd30e1cb72f794951a2619dc236f3b63d4338f60467e616f269f5f320af9d39bbe274b1fd3c4a0118bdc1e5b3dbaf8d099a6b05f
-
SSDEEP
12288:gG0XBelGgbghrGlwqW2NinHlsUFXpVW5YFg3mY/q3aErbAd:gG0XBelGgkhrGlwqW2NinHlsUFZVW5/l
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2124 2040 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2040 1684 rundll32.exe 28 PID 1684 wrote to memory of 2040 1684 rundll32.exe 28 PID 1684 wrote to memory of 2040 1684 rundll32.exe 28 PID 1684 wrote to memory of 2040 1684 rundll32.exe 28 PID 1684 wrote to memory of 2040 1684 rundll32.exe 28 PID 1684 wrote to memory of 2040 1684 rundll32.exe 28 PID 1684 wrote to memory of 2040 1684 rundll32.exe 28 PID 2040 wrote to memory of 2124 2040 rundll32.exe 29 PID 2040 wrote to memory of 2124 2040 rundll32.exe 29 PID 2040 wrote to memory of 2124 2040 rundll32.exe 29 PID 2040 wrote to memory of 2124 2040 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3fb3e342d03db4eb325fa35949dac380_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3fb3e342d03db4eb325fa35949dac380_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 2323⤵
- Program crash
PID:2124
-
-