ea1c7ec7ccde4b5e4eb00c9e32118a59c3ea259090f8f3efa847069627518b66

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 23:51

Target

31e76e90c75beb4c97968b352959f6d0_NeikiAnalytics.dll
Size

6KB
MD5

31e76e90c75beb4c97968b352959f6d0
SHA1

03e36f26407a83b926994eb41844c51a0d9bde94
SHA256

ea1c7ec7ccde4b5e4eb00c9e32118a59c3ea259090f8f3efa847069627518b66
SHA512

46b98a0a296be6ca52952c2f6b799c7ce1c28b188db118b363dd0eb6436a73552c2b10455f18b79e2056773e93f3d3a0105be47d03e3fa26775eec9d811b4270
SSDEEP

48:SsGp63gAST0cMLlD7prUlG9NzgX9nJfv1rJ3ltZWHKeWTflslsZqxHP7Sy0i3Yue:VGEETrMLH5gnTkKlNsl/jS7G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31e76e90c75beb4c97968b352959f6d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31e76e90c75beb4c97968b352959f6d0_NeikiAnalytics.dll,#1
  2⤵
  PID:2256