Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 19:13
Behavioral task
behavioral1
Sample
0ecca82325ca7a306990141755e8f710_NeikiAnalytics.dll
Resource
win7-20240215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ecca82325ca7a306990141755e8f710_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
0ecca82325ca7a306990141755e8f710_NeikiAnalytics.dll
-
Size
74KB
-
MD5
0ecca82325ca7a306990141755e8f710
-
SHA1
92c17e3cb3d7336d33e4d08e997fff88c6665cce
-
SHA256
b0c00129dcd7657cb0c7dd2d6e318bc29ea3062cd3369cf572fe15d2d7b53e41
-
SHA512
da39bca5045155fa3d13133ae707a94ddfe65b8362f8bc7c0fb2f30e4f292fa11334be1509e83d703f020456eb958973d297bf0b989cdb8c4da53a60059a5c0a
-
SSDEEP
1536:QZZZZZZZZZZZZpXzzzzzzzzzzzziMgDSctY8w3iQjFruiMAKjaMqqU+2bbbAV2/m:xTntqSQRruiMuMqqDL2/Awvd
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2324 1856 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1844 wrote to memory of 1856 1844 rundll32.exe rundll32.exe PID 1844 wrote to memory of 1856 1844 rundll32.exe rundll32.exe PID 1844 wrote to memory of 1856 1844 rundll32.exe rundll32.exe PID 1844 wrote to memory of 1856 1844 rundll32.exe rundll32.exe PID 1844 wrote to memory of 1856 1844 rundll32.exe rundll32.exe PID 1844 wrote to memory of 1856 1844 rundll32.exe rundll32.exe PID 1844 wrote to memory of 1856 1844 rundll32.exe rundll32.exe PID 1856 wrote to memory of 2324 1856 rundll32.exe WerFault.exe PID 1856 wrote to memory of 2324 1856 rundll32.exe WerFault.exe PID 1856 wrote to memory of 2324 1856 rundll32.exe WerFault.exe PID 1856 wrote to memory of 2324 1856 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ecca82325ca7a306990141755e8f710_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ecca82325ca7a306990141755e8f710_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 2283⤵
- Program crash
PID:2324