081a0c0e76841e19f50214280128dc56175bbc38461fc509a6068191b96a0ace | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 08:00

Sharing

Report Analysis Logs

General

Target

e2941d53e1c37eecf303fec983c0d8c0_NeikiAnalytics.dll
Size

3KB
MD5

e2941d53e1c37eecf303fec983c0d8c0
SHA1

9c6d891acde282d214449e2e8e4a3ee18a10bb0f
SHA256

081a0c0e76841e19f50214280128dc56175bbc38461fc509a6068191b96a0ace
SHA512

fed4d7ee973cce11467ebace8c9150e09204f28d0e16a447eebc8b097c52f0117c9e0de87bef703e283d53440b65becd7b84175201b3d111f418c88356db0046

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2941d53e1c37eecf303fec983c0d8c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2941d53e1c37eecf303fec983c0d8c0_NeikiAnalytics.dll,#1
  2⤵
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads