e92feeca82f94484d3dcf408ebe353c3a98df54d1e431e8f7d87b2cbbdcfbb2f | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

26ee9238e21ab8ae6c40964df17e46b0_NeikiAnalytics.dll
Size

3KB
MD5

26ee9238e21ab8ae6c40964df17e46b0
SHA1

3759b6a8c6026add481cfdcfdb9878c21ab2189d
SHA256

e92feeca82f94484d3dcf408ebe353c3a98df54d1e431e8f7d87b2cbbdcfbb2f
SHA512

8420028287c9b97b8c96d4b72fa983da115bd59c13f68ff3176db3016d4c803d34489499f6dd7a3b8f02aef3f3af53872146c04c6a795163bf521ba170f7ad90

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2988	1444	rundll32.exe	28
PID 1444 wrote to memory of 2988	1444	rundll32.exe	28
PID 1444 wrote to memory of 2988	1444	rundll32.exe	28
PID 1444 wrote to memory of 2988	1444	rundll32.exe	28
PID 1444 wrote to memory of 2988	1444	rundll32.exe	28
PID 1444 wrote to memory of 2988	1444	rundll32.exe	28
PID 1444 wrote to memory of 2988	1444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26ee9238e21ab8ae6c40964df17e46b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26ee9238e21ab8ae6c40964df17e46b0_NeikiAnalytics.dll,#1
  2⤵
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads