Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 13:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a4e2f530bdf8cbf79a7679d5847fef70_NeikiAnalytics.dll
Resource
win7-20240508-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4e2f530bdf8cbf79a7679d5847fef70_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
a4e2f530bdf8cbf79a7679d5847fef70_NeikiAnalytics.dll
-
Size
6KB
-
MD5
a4e2f530bdf8cbf79a7679d5847fef70
-
SHA1
3bf3f781d020b1eed6e84f4c69d7e25610cbe101
-
SHA256
27082f003291358b59f3c02fbe375f71b1afa8aff79e03e12162b555b1518f45
-
SHA512
46e186a6354d1b17e65e821188bcafcd269d1d443445c9f30220295f51ca3da9ff96cf77c996e2d586918c241f3fe7a83a2e276cc7f8d618e685d78bebc1f844
-
SSDEEP
96:DixZjmjtjd8jPjcZGR5TIDRVpRbu/bd+vg1+l6WqSQ+g+T5SDjCQVmNa:unSR6bgYcrbm0vFl67S5pT5SDjCQV
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5888 wrote to memory of 1008 5888 rundll32.exe 82 PID 5888 wrote to memory of 1008 5888 rundll32.exe 82 PID 5888 wrote to memory of 1008 5888 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4e2f530bdf8cbf79a7679d5847fef70_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4e2f530bdf8cbf79a7679d5847fef70_NeikiAnalytics.dll,#12⤵PID:1008
-