5df4f19cf39ca316119e1d2982427af74a8c61e4f1edca767645d60ec2d9cda4 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

407930ae3a2bef865c954c47bc0abe00_NeikiAnalytics.dll
Size

4KB
MD5

407930ae3a2bef865c954c47bc0abe00
SHA1

3f79e970c71027627a41b8bfde719f485bb58ff1
SHA256

5df4f19cf39ca316119e1d2982427af74a8c61e4f1edca767645d60ec2d9cda4
SHA512

c42ad470145e02b81875bfbf21ccfef93787f9acf008e7adb66b55eb101e14a9640e6a72b048f7304d80cb226746d2c05056d33196272db4a2685960d374d7e9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2100	2108	rundll32.exe	28
PID 2108 wrote to memory of 2100	2108	rundll32.exe	28
PID 2108 wrote to memory of 2100	2108	rundll32.exe	28
PID 2108 wrote to memory of 2100	2108	rundll32.exe	28
PID 2108 wrote to memory of 2100	2108	rundll32.exe	28
PID 2108 wrote to memory of 2100	2108	rundll32.exe	28
PID 2108 wrote to memory of 2100	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\407930ae3a2bef865c954c47bc0abe00_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\407930ae3a2bef865c954c47bc0abe00_NeikiAnalytics.dll,#1
  2⤵
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads