5318d0e10a6eb2c6710ceb5c31a1a29ed00d6ba6233cddc1cb04f38daf8ffb30 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 00:54

Sharing

Report Analysis Logs

General

Target

695fff746d6ad82b4c5b0005752515a0_NeikiAnalytics.dll
Size

4KB
MD5

695fff746d6ad82b4c5b0005752515a0
SHA1

491d9c5fc5492e099132beac3dc2436fefb703f7
SHA256

5318d0e10a6eb2c6710ceb5c31a1a29ed00d6ba6233cddc1cb04f38daf8ffb30
SHA512

91324cc5aa5a74a34e68e04e799a7f44a30252cb76393fc32be122b04adc08131022921a555a41c2e337b76c29cfe31379a9e44ca65e131d06209a429c6008a1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\695fff746d6ad82b4c5b0005752515a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\695fff746d6ad82b4c5b0005752515a0_NeikiAnalytics.dll,#1
  2⤵
  PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads