Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 12:32
Static task
static1
Behavioral task
behavioral1
Sample
4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
General
-
Target
4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8_NeikiAnalytics.dll
-
Size
81KB
-
MD5
162df44d34a39aedf0993d678a7824f0
-
SHA1
9831a401497a1652da22648a8a82e431254de8b8
-
SHA256
4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8
-
SHA512
ecef0f0e7d470a172048babf1cd2a3c93396a89f511625d7d1cb01a80d405238d1f9720e16cf2e906922c06926444cf8e76e1d6c998c61aa5d4196523c06fe54
-
SSDEEP
1536:8tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wd:84v4JKXTx71w0ArSsXF3enq8Wd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2076 2756 rundll32.exe 28 PID 2756 wrote to memory of 2076 2756 rundll32.exe 28 PID 2756 wrote to memory of 2076 2756 rundll32.exe 28 PID 2756 wrote to memory of 2076 2756 rundll32.exe 28 PID 2756 wrote to memory of 2076 2756 rundll32.exe 28 PID 2756 wrote to memory of 2076 2756 rundll32.exe 28 PID 2756 wrote to memory of 2076 2756 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8_NeikiAnalytics.dll,#12⤵PID:2076
-