442b2d5b678adf8c24f40d49b5d90258c2193caa5cedc854b4f3812d2035de08

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 20:02

Target

e4d2a773dfbe336d1b4af716ceb4cd40_NeikiAnalytics.dll
Size

148KB
MD5

e4d2a773dfbe336d1b4af716ceb4cd40
SHA1

7a7116c56ca89d445522b9c7070db1005d326e8d
SHA256

442b2d5b678adf8c24f40d49b5d90258c2193caa5cedc854b4f3812d2035de08
SHA512

f6af33496d7fdbb3184dac9f2fedd31a46cf01083e4e39f37a162b5f7a077c0136b217beea8aba67533ba196aca52efd79c06a6cffce7d7c6f67ed75083c8adc
SSDEEP

3072:q2PZ9+cYYefornDRunRtezjaISUqfKm8ydCE8bRknIQwwj3f8TX34kNOHbvhkzmu:q2PZ9+cYYefornDRunRtezjaISUqCm8p

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4d2a773dfbe336d1b4af716ceb4cd40_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4d2a773dfbe336d1b4af716ceb4cd40_NeikiAnalytics.dll,#1
  2⤵
  PID:2132