9599f61d8664808e971c02bdbe739aa6aa064e40904a1e3eef37f05c4fcda08c | Triage

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:42

Sharing

Report Analysis Logs

General

Target

36c7e1d2020df03946e069dc4abfcbb0_NeikiAnalytics.dll
Size

6KB
MD5

36c7e1d2020df03946e069dc4abfcbb0
SHA1

2ad9498682977f4d70704fbc9333301514bd681f
SHA256

9599f61d8664808e971c02bdbe739aa6aa064e40904a1e3eef37f05c4fcda08c
SHA512

84c9eb5c0b913e99230cf285baac9ba2a09dd0e75a9974c4857747ea7da0523b0515cff02acbbbfa1581142064ada09912901db6b7ebf4e4bb32b2b6677a4e12
SSDEEP

96:hy859x0P8MaQ89KJZuMkQ31+3P3DRJOin:F5oLbrkQ31+7H

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2136 wrote to memory of 4844	2136	rundll32.exe	rundll32.exe
PID 2136 wrote to memory of 4844	2136	rundll32.exe	rundll32.exe
PID 2136 wrote to memory of 4844	2136	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36c7e1d2020df03946e069dc4abfcbb0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36c7e1d2020df03946e069dc4abfcbb0_NeikiAnalytics.dll,#1
2⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...