Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 04:21
Behavioral task
behavioral1
Sample
76e213da78ba8bfd0b65e9ff9b6c5b70_NeikiAnalytics.dll
Resource
win7-20240508-en
3 signatures
150 seconds
General
-
Target
76e213da78ba8bfd0b65e9ff9b6c5b70_NeikiAnalytics.dll
-
Size
38KB
-
MD5
76e213da78ba8bfd0b65e9ff9b6c5b70
-
SHA1
d7e47a874ca1d396ae09534f3cee3fd66919466a
-
SHA256
ab6740bda183a9355a14c3e39439dd6286acd8cd9969f7ae337b8a94cebfad85
-
SHA512
a745c75a335283766f0cc6f6a794466dc7711183dee948ef6be300c7f8f0f8cab342b5c0b1d0dc81a0354a8ffd0a3ee65a9d9c237c2ce14cb6eb9d4708fa26f0
-
SSDEEP
768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV70IXUi6m2sSwVV:WD8w22laSR0V+3CJrVLXpzJS
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1896 wrote to memory of 2236 1896 rundll32.exe 28 PID 1896 wrote to memory of 2236 1896 rundll32.exe 28 PID 1896 wrote to memory of 2236 1896 rundll32.exe 28 PID 1896 wrote to memory of 2236 1896 rundll32.exe 28 PID 1896 wrote to memory of 2236 1896 rundll32.exe 28 PID 1896 wrote to memory of 2236 1896 rundll32.exe 28 PID 1896 wrote to memory of 2236 1896 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\76e213da78ba8bfd0b65e9ff9b6c5b70_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\76e213da78ba8bfd0b65e9ff9b6c5b70_NeikiAnalytics.dll,#12⤵
- Drops file in System32 directory
PID:2236
-