d1bb123d04d8b4682fb7c0ff8446ad62bba74875025718c97d8df88a92429025

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 23:08

Target

2661786aaf13be215c3010ecee9ad180_NeikiAnalytics.dll
Size

869KB
MD5

2661786aaf13be215c3010ecee9ad180
SHA1

78d793f163ac5326c9ac54a09640ac7c48242942
SHA256

d1bb123d04d8b4682fb7c0ff8446ad62bba74875025718c97d8df88a92429025
SHA512

35e92578c96e5ab39f7f20ed04e7ae592e3eaa596095df74793862ad8e43a9c421600952c13cb7ce2d9f56f4a6ce26465e4d5f0d5500eb05c681683577b87285
SSDEEP

24576:OGMKNExePNaWgltFhLIRrrwQIfir9q7jW/5WiQMzU2+:xIXDQkJfWq7jcWiRB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2012	1660	rundll32.exe	28
PID 1660 wrote to memory of 2012	1660	rundll32.exe	28
PID 1660 wrote to memory of 2012	1660	rundll32.exe	28
PID 1660 wrote to memory of 2012	1660	rundll32.exe	28
PID 1660 wrote to memory of 2012	1660	rundll32.exe	28
PID 1660 wrote to memory of 2012	1660	rundll32.exe	28
PID 1660 wrote to memory of 2012	1660	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2661786aaf13be215c3010ecee9ad180_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2661786aaf13be215c3010ecee9ad180_NeikiAnalytics.dll,#1
  2⤵
  PID:2012

memory/2012-2-0x0000000000AF0000-0x0000000000C78000-memory.dmp

Filesize
1.5MB

Download
memory/2012-4-0x0000000000210000-0x0000000000213000-memory.dmp

Filesize
12KB

Download
memory/2012-3-0x0000000000AF0000-0x0000000000C78000-memory.dmp

Filesize
1.5MB

Download
memory/2012-1-0x0000000000AF0000-0x0000000000C78000-memory.dmp

Filesize
1.5MB

Download
memory/2012-0-0x0000000000AF0000-0x0000000000C78000-memory.dmp

Filesize
1.5MB

Download
memory/2012-5-0x0000000000210000-0x0000000000213000-memory.dmp

Filesize
12KB

Download