69142cd462363832ab2bedb21396163838ee8e0a9b0a6c5dff73983f74b25184 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-06-2024 02:37

Sharing

Report Analysis Logs

General

Target

0bbd2260e7b5ac9448e1c7b757472b50_NeikiAnalytics.dll
Size

4KB
MD5

0bbd2260e7b5ac9448e1c7b757472b50
SHA1

21074c0d927e8d26aa43d96f515a21a06cd891ed
SHA256

69142cd462363832ab2bedb21396163838ee8e0a9b0a6c5dff73983f74b25184
SHA512

30fdd45d49ea0ae8abcf06dbb152ed57980a6d1d77f56167be89e2e3aa0a8c5d9f3816c8e94539dd86605ea0d62063f1d7240a2373b0ea36b45a96b62d423917

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2264	2088	rundll32.exe	28
PID 2088 wrote to memory of 2264	2088	rundll32.exe	28
PID 2088 wrote to memory of 2264	2088	rundll32.exe	28
PID 2088 wrote to memory of 2264	2088	rundll32.exe	28
PID 2088 wrote to memory of 2264	2088	rundll32.exe	28
PID 2088 wrote to memory of 2264	2088	rundll32.exe	28
PID 2088 wrote to memory of 2264	2088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bbd2260e7b5ac9448e1c7b757472b50_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bbd2260e7b5ac9448e1c7b757472b50_NeikiAnalytics.dll,#1
  2⤵
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads