4d4ede2c0418271515e3e29411ab4c3b1666063cc1458b420d5714121cc285e7 | Triage

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 20:47

Sharing

Report Analysis Logs

General

Target

31d0a936026828b6ed9a29ec84ce3870_NeikiAnalytics.dll
Size

5KB
MD5

31d0a936026828b6ed9a29ec84ce3870
SHA1

30475450ca29e214a9ba5bbfa08301b46e5e0afc
SHA256

4d4ede2c0418271515e3e29411ab4c3b1666063cc1458b420d5714121cc285e7
SHA512

9769eae1d91f824932da81f2bd0c595642cbc69ce0b77f9892ee7f80fa69faf582541422b49b6278afc6cab3afacc5e7327494fdd37a140c30cc479052b41329
SSDEEP

96:DixZjmjtjd8jPjcZGR5TI2zbLo7JWiKkzO7:unSR6bgYJ7kV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 2616	1356	rundll32.exe	83
PID 1356 wrote to memory of 2616	1356	rundll32.exe	83
PID 1356 wrote to memory of 2616	1356	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d0a936026828b6ed9a29ec84ce3870_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d0a936026828b6ed9a29ec84ce3870_NeikiAnalytics.dll,#1
  2⤵
  PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads