5592d1b8ca05a0d6006267ae219a736341411b642aeb26e7444f7d0e88e8db09 | Triage

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

91438f32c913e9e86710b75b60ccf1a0_NeikiAnalytics.dll
Size

5KB
MD5

91438f32c913e9e86710b75b60ccf1a0
SHA1

7f07d1c6564249f4422254a71beba4a6a1e40ba2
SHA256

5592d1b8ca05a0d6006267ae219a736341411b642aeb26e7444f7d0e88e8db09
SHA512

83cd1e5d5e28a2bb9e037b785a742df75bfcb73f3103324e84988c110773779571fcb193e983a7f493666c5e907bef1110d8df4e87c00a6cf2dd88f52e0982d8
SSDEEP

96:nEY2RrF1eqwi4KhiAAAAOlAr57BmBWEr:EHRh1eppGS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3804	2880	rundll32.exe	89
PID 2880 wrote to memory of 3804	2880	rundll32.exe	89
PID 2880 wrote to memory of 3804	2880	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91438f32c913e9e86710b75b60ccf1a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91438f32c913e9e86710b75b60ccf1a0_NeikiAnalytics.dll,#1
  2⤵
  PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3584,i,6041070687820623968,3004230300437737550,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
1⤵
PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads