Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
077860a925aca6e0d9210ffb033fcc80_NeikiAnalytics.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
077860a925aca6e0d9210ffb033fcc80_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
077860a925aca6e0d9210ffb033fcc80_NeikiAnalytics.dll
-
Size
81KB
-
MD5
077860a925aca6e0d9210ffb033fcc80
-
SHA1
faa16950bc9b2a776c6d000d2d08054cd1021759
-
SHA256
f497137ee47449d98f8d997ce0bcc126dc406726d557d40ed0ad031d034c7c08
-
SHA512
a330aa435c891cc3fadee802bb230fc5b673af147eb38d521461c1940a2a7279e9e4e5d187868a1f1d7919dd6cfea170789bcd96bbc7a585a83ed9797baeafa0
-
SSDEEP
1536:7tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wq:74v4JKXTx71w0ArSsXF3enq8Wq
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2180 1916 rundll32.exe 28 PID 1916 wrote to memory of 2180 1916 rundll32.exe 28 PID 1916 wrote to memory of 2180 1916 rundll32.exe 28 PID 1916 wrote to memory of 2180 1916 rundll32.exe 28 PID 1916 wrote to memory of 2180 1916 rundll32.exe 28 PID 1916 wrote to memory of 2180 1916 rundll32.exe 28 PID 1916 wrote to memory of 2180 1916 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\077860a925aca6e0d9210ffb033fcc80_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\077860a925aca6e0d9210ffb033fcc80_NeikiAnalytics.dll,#12⤵PID:2180
-