Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 13:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a4e2f530bdf8cbf79a7679d5847fef70_NeikiAnalytics.dll
Resource
win7-20240508-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4e2f530bdf8cbf79a7679d5847fef70_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
a4e2f530bdf8cbf79a7679d5847fef70_NeikiAnalytics.dll
-
Size
6KB
-
MD5
a4e2f530bdf8cbf79a7679d5847fef70
-
SHA1
3bf3f781d020b1eed6e84f4c69d7e25610cbe101
-
SHA256
27082f003291358b59f3c02fbe375f71b1afa8aff79e03e12162b555b1518f45
-
SHA512
46e186a6354d1b17e65e821188bcafcd269d1d443445c9f30220295f51ca3da9ff96cf77c996e2d586918c241f3fe7a83a2e276cc7f8d618e685d78bebc1f844
-
SSDEEP
96:DixZjmjtjd8jPjcZGR5TIDRVpRbu/bd+vg1+l6WqSQ+g+T5SDjCQVmNa:unSR6bgYcrbm0vFl67S5pT5SDjCQV
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2652 2196 rundll32.exe 28 PID 2196 wrote to memory of 2652 2196 rundll32.exe 28 PID 2196 wrote to memory of 2652 2196 rundll32.exe 28 PID 2196 wrote to memory of 2652 2196 rundll32.exe 28 PID 2196 wrote to memory of 2652 2196 rundll32.exe 28 PID 2196 wrote to memory of 2652 2196 rundll32.exe 28 PID 2196 wrote to memory of 2652 2196 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4e2f530bdf8cbf79a7679d5847fef70_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4e2f530bdf8cbf79a7679d5847fef70_NeikiAnalytics.dll,#12⤵PID:2652
-