d1d44b94eba6eaebbce9d780dbc26170ed1c68e082a6e9b83556efc03947c880 | Triage

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 22:22

Sharing

Report Analysis Logs

General

Target

0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll
Size

1.6MB
MD5

0e29892787f2fc38005763ca5950c920
SHA1

a0bac45ac8b90530954dcdd51b483acf933e6b4b
SHA256

d1d44b94eba6eaebbce9d780dbc26170ed1c68e082a6e9b83556efc03947c880
SHA512

e1790f4528c71a12314bcf2f0cc63ef0efc8f096a96cc37839041d20c4f16b48451acf3367e1488d94cc90422bc6e667bf2196c85a16ccc9b2da42cdd671c0b9
SSDEEP

49152:hsPNbvGpw+s8KuqGaX0ToIBAUZLYBwnA:ilbvETJBAUZLI

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3740	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3740	2136	rundll32.exe	83
PID 2136 wrote to memory of 3740	2136	rundll32.exe	83
PID 2136 wrote to memory of 3740	2136	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e29892787f2fc38005763ca5950c920_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads