e8abab5835c1a43cb1ee198004b7871bb574032c4675a35358d75736c140e85e | Triage

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b286f902eb035c988d83047b018eb330_NeikiAnalytics.dll
Size

6KB
MD5

b286f902eb035c988d83047b018eb330
SHA1

8c21ac3f30a9e43a590eabcfe5822961967c90e3
SHA256

e8abab5835c1a43cb1ee198004b7871bb574032c4675a35358d75736c140e85e
SHA512

7f7378680762aeff6f0a8f02c04db51fbf45330b597419c9e73828800fd40af7ff38d0679c608793b0a6135f3db0b7a68d623a065afe3b1d3c41f9fe05541eed
SSDEEP

96:hyZxm/jmjhjvj3jcZGV47ETJ07cGs2Bm9Uj:2M/SdjbgYvawGs2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4660	1188	rundll32.exe	89
PID 1188 wrote to memory of 4660	1188	rundll32.exe	89
PID 1188 wrote to memory of 4660	1188	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b286f902eb035c988d83047b018eb330_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b286f902eb035c988d83047b018eb330_NeikiAnalytics.dll,#1
  2⤵
  PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads