3babb62ef5c4c04639f8d467d964fce44b7f5b711784e86b21704a8551b26678 | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 21:49

Sharing

Report Analysis Logs

General

Target

1e0260158df06e9d2fece3a36c169290_NeikiAnalytics.dll
Size

3KB
MD5

1e0260158df06e9d2fece3a36c169290
SHA1

ce2125943caead521f956d5d35b57208ad8ee40a
SHA256

3babb62ef5c4c04639f8d467d964fce44b7f5b711784e86b21704a8551b26678
SHA512

29c62baad399a010ac88a7b319e98a8abc2588db9e9e92a4536c29b53150d648f4980b21bce50e63db61f90a30f6e781bc4570e47b5af0cd8a9d06891a6261f4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e0260158df06e9d2fece3a36c169290_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e0260158df06e9d2fece3a36c169290_NeikiAnalytics.dll,#1
  2⤵
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads