281c2fe5250fa5b1f398e7ca6ddb90cd6a5774640d27efb3a0280a9fa983f694 | Triage

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 00:02

Sharing

Report Analysis Logs

General

Target

281c2fe5250fa5b1f398e7ca6ddb90cd6a5774640d27efb3a0280a9fa983f694_NeikiAnalytics.dll
Size

3KB
MD5

19c899ca7c1b84964e331329d9512330
SHA1

79b2525dee36f7da44c71c335ac5d1d7f98a2bf5
SHA256

281c2fe5250fa5b1f398e7ca6ddb90cd6a5774640d27efb3a0280a9fa983f694
SHA512

493dda99f2bc8b1f1a7614fb1f8c6dbe3736905c9684b4f5926f4fb94021e3acdd685d9f03ee0c7eeb9505e6fd27d88a81c62f4b69572ef5c8d41c1ec712daa5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 1404	3580	rundll32.exe	82
PID 3580 wrote to memory of 1404	3580	rundll32.exe	82
PID 3580 wrote to memory of 1404	3580	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\281c2fe5250fa5b1f398e7ca6ddb90cd6a5774640d27efb3a0280a9fa983f694_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\281c2fe5250fa5b1f398e7ca6ddb90cd6a5774640d27efb3a0280a9fa983f694_NeikiAnalytics.dll,#1
  2⤵
  PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads