d1d44b94eba6eaebbce9d780dbc26170ed1c68e082a6e9b83556efc03947c880 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 22:22

Sharing

Report Analysis Logs

General

Target

0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll
Size

1.6MB
MD5

0e29892787f2fc38005763ca5950c920
SHA1

a0bac45ac8b90530954dcdd51b483acf933e6b4b
SHA256

d1d44b94eba6eaebbce9d780dbc26170ed1c68e082a6e9b83556efc03947c880
SHA512

e1790f4528c71a12314bcf2f0cc63ef0efc8f096a96cc37839041d20c4f16b48451acf3367e1488d94cc90422bc6e667bf2196c85a16ccc9b2da42cdd671c0b9
SSDEEP

49152:hsPNbvGpw+s8KuqGaX0ToIBAUZLYBwnA:ilbvETJBAUZLI

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2956	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads