Analysis
-
max time kernel
134s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
089beb1d9216ec0928cec66b1c432a10_NeikiAnalytics.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
089beb1d9216ec0928cec66b1c432a10_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
089beb1d9216ec0928cec66b1c432a10_NeikiAnalytics.dll
-
Size
81KB
-
MD5
089beb1d9216ec0928cec66b1c432a10
-
SHA1
73b2942120880b70f1999be876b2ef7dc2abc83c
-
SHA256
c193280a62113f1ac4efe3ef409f85199572faa413b57563a1e826aaa767cbb5
-
SHA512
b942e3d0a837b74a9cd307c4f4ad619508526f4eddddfaf42a1d02deb9554c6de550a415c22dc4b89ee8283ee3327a1edd75150084f80a84b34994cc3a50fa7a
-
SSDEEP
1536:StByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wo:S4v4JKXTx71w0ArSsXF3enq8Wo
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3432 wrote to memory of 2012 3432 rundll32.exe 82 PID 3432 wrote to memory of 2012 3432 rundll32.exe 82 PID 3432 wrote to memory of 2012 3432 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\089beb1d9216ec0928cec66b1c432a10_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\089beb1d9216ec0928cec66b1c432a10_NeikiAnalytics.dll,#12⤵PID:2012
-