c421357cf257090943e8fe47e369ea3cc5cc4dfaac2f342d6450b486568d2763

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 23:11

Target

1ad4a910cdfc81667af99020d2029f40_NeikiAnalytics.dll
Size

5KB
MD5

1ad4a910cdfc81667af99020d2029f40
SHA1

aef3fbcbb90dd0d1378dd82d7e699f74ae769dd3
SHA256

c421357cf257090943e8fe47e369ea3cc5cc4dfaac2f342d6450b486568d2763
SHA512

ce1914f6b07f00784a351a9426c736bd9e468587d7ffe52623308964ed1f2e2bd0f5b47168b5c8d94b44757536b4400a4725de14788a2af3820b5ffd029517d4
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqk1njFPRFq1rsxYwv+/dsjfZVcVduXdnvQs:hy859x0P8Mak1hpEUMqjXc7gdYs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2004	1868	rundll32.exe	28
PID 1868 wrote to memory of 2004	1868	rundll32.exe	28
PID 1868 wrote to memory of 2004	1868	rundll32.exe	28
PID 1868 wrote to memory of 2004	1868	rundll32.exe	28
PID 1868 wrote to memory of 2004	1868	rundll32.exe	28
PID 1868 wrote to memory of 2004	1868	rundll32.exe	28
PID 1868 wrote to memory of 2004	1868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ad4a910cdfc81667af99020d2029f40_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ad4a910cdfc81667af99020d2029f40_NeikiAnalytics.dll,#1
  2⤵
  PID:2004