c1a61aff6c7aa733d718b8550e4c6a383da9648fd95e6d1aa9f11ff5cc8c9eaf | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:23

Sharing

Report Analysis Logs

General

Target

06310ddd125c358f21223569e4fd9dd0_NeikiAnalytics.dll
Size

3KB
MD5

06310ddd125c358f21223569e4fd9dd0
SHA1

2327a0d916af0cfbba18def4162f124cc54ab2cc
SHA256

c1a61aff6c7aa733d718b8550e4c6a383da9648fd95e6d1aa9f11ff5cc8c9eaf
SHA512

a2aed30817176e1a3cfabc5c58afaa6e55df6e076ee2f7ca183e924c93c2a75659be2f4c5c8c802746c98e6092f876705065b1dfe3bc7756f21663b01d5ebd62

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2052 wrote to memory of 1616	2052	rundll32.exe	rundll32.exe
PID 2052 wrote to memory of 1616	2052	rundll32.exe	rundll32.exe
PID 2052 wrote to memory of 1616	2052	rundll32.exe	rundll32.exe
PID 2052 wrote to memory of 1616	2052	rundll32.exe	rundll32.exe
PID 2052 wrote to memory of 1616	2052	rundll32.exe	rundll32.exe
PID 2052 wrote to memory of 1616	2052	rundll32.exe	rundll32.exe
PID 2052 wrote to memory of 1616	2052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06310ddd125c358f21223569e4fd9dd0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06310ddd125c358f21223569e4fd9dd0_NeikiAnalytics.dll,#1
2⤵
PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads