Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 01:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll
Resource
win7-20240419-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll
-
Size
94KB
-
MD5
5e177b1a18e0831839f8bbc08c1de620
-
SHA1
8352fea352e99c31040f071d2cd45d382c89a3bf
-
SHA256
bd8694b7a638e9f45fce931699f806ddbfd9e3ab356027f509cdd611be62f978
-
SHA512
1b4730c95e27671086555850f919e1d4264c5a1d70af9a4a2a2ccd2ee03d56f3439d6edc5ac256e7e42f1975fcae4d6316f0d5dae100127d32b8ba054b077ced
-
SSDEEP
1536:nx52vQBKLmh4jIUs7ghzerjJC8kVidxfUjQRKr2nTWExTOojRO:nxIvQBK+7rghzSLkIdxfmQ0oTOoj
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3140 3448 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4344 wrote to memory of 3448 4344 rundll32.exe 83 PID 4344 wrote to memory of 3448 4344 rundll32.exe 83 PID 4344 wrote to memory of 3448 4344 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll,#12⤵PID:3448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 6003⤵
- Program crash
PID:3140
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3448 -ip 34481⤵PID:212