Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 23:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b41c4dc1b2c72ccf6094dd14fa13a40_NeikiAnalytics.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b41c4dc1b2c72ccf6094dd14fa13a40_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
4b41c4dc1b2c72ccf6094dd14fa13a40_NeikiAnalytics.dll
-
Size
6KB
-
MD5
4b41c4dc1b2c72ccf6094dd14fa13a40
-
SHA1
13cefe2966e66f95efb942466b3ecc71e6672bae
-
SHA256
c3967eaaf7d9410cdb78aad0e15aea66060cddc0d455ffef2d0b69f94af391e9
-
SHA512
cb7b7b3e297c32e6efd25ad31cde92745613885fc0eac0cd0e9412a57f644ef0b27479236af7fd7e330b5a15279325ced0734f83ef6f9beb1fa36424f61f072f
-
SSDEEP
96:nEY2RrF1eqwi4/fUduhMKojSVRaJ2Qz3UzrV/9bt8C3nDwcU+sl:EHRh1epp/sSsSnIdzEzx/2
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4016 wrote to memory of 3644 4016 rundll32.exe 81 PID 4016 wrote to memory of 3644 4016 rundll32.exe 81 PID 4016 wrote to memory of 3644 4016 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b41c4dc1b2c72ccf6094dd14fa13a40_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b41c4dc1b2c72ccf6094dd14fa13a40_NeikiAnalytics.dll,#12⤵PID:3644
-