07049171cda8c7a348f5f7a60175c2d4ade52a4b477a0ae0df796513ba289b98

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 15:07

Target

6c311ea6792f3f24e23d4eb9a1b64160_NeikiAnalytics.dll
Size

172KB
MD5

6c311ea6792f3f24e23d4eb9a1b64160
SHA1

b6aa8849a6ee058134049f5bea9f5c54bee15b4e
SHA256

07049171cda8c7a348f5f7a60175c2d4ade52a4b477a0ae0df796513ba289b98
SHA512

15d5adf5148f83655d2402ba248e6cfeaa86c774d1f598a84e6f409455b483a6a421de9712677c68856de4d8442677267635b8b3d5b88ce2831d2795f3e3e195
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2384	2416	rundll32.exe	28
PID 2416 wrote to memory of 2384	2416	rundll32.exe	28
PID 2416 wrote to memory of 2384	2416	rundll32.exe	28
PID 2416 wrote to memory of 2384	2416	rundll32.exe	28
PID 2416 wrote to memory of 2384	2416	rundll32.exe	28
PID 2416 wrote to memory of 2384	2416	rundll32.exe	28
PID 2416 wrote to memory of 2384	2416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c311ea6792f3f24e23d4eb9a1b64160_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c311ea6792f3f24e23d4eb9a1b64160_NeikiAnalytics.dll,#1
  2⤵
  PID:2384

memory/2384-1-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2384-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2384-2-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download