Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 19:57
Static task
static1
Behavioral task
behavioral1
Sample
b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3_NeikiAnalytics.dll
-
Size
6KB
-
MD5
c1313e24f7e1823691401f96bbe27be0
-
SHA1
387fe77faf513a4b033db2c77a5532d3571e5ad6
-
SHA256
b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3
-
SHA512
35e99090d76660439a0b4d21740a72b33468d7285a6e9c6c4290ffa1e582c0314c99452ddf2885f62279c34eff7091b8bec947c99bbc139a412928092406d036
-
SSDEEP
48:6WQV5YVOqtV0H1pw9ygYVUG0VnB+BDq9J5SC:8qtV0HAr4IB+FqX5SC
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2472 wrote to memory of 5068 2472 rundll32.exe 80 PID 2472 wrote to memory of 5068 2472 rundll32.exe 80 PID 2472 wrote to memory of 5068 2472 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3_NeikiAnalytics.dll,#12⤵PID:5068
-