0dc6e90ad44493a38ebd149fb94a6c46b4979238f14e3e279d67b7ec11c0b765

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 00:13

Target

2987bb711165f62831e9da5ffcfed9b0_NeikiAnalytics.dll
Size

168KB
MD5

2987bb711165f62831e9da5ffcfed9b0
SHA1

8208ed08ce62238cda6e8db582c6b99e03168ace
SHA256

0dc6e90ad44493a38ebd149fb94a6c46b4979238f14e3e279d67b7ec11c0b765
SHA512

34792c2dfc027e09c487f3ad0a8ae77476032b80664acc226e92496f35ada5dde40cb2889094d7ca9d29b6fa734461b977a20660fbf43c805f7a93c06c58fcf3
SSDEEP

96:+iNpTnJtsZLpdcDYbo7NkIf7YcPHLsWagfUZWlAOed8R2PRfw+wzlvGk:dHTn85TCXpPHF9cZWl9CS2Szl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1732	2228	rundll32.exe	28
PID 2228 wrote to memory of 1732	2228	rundll32.exe	28
PID 2228 wrote to memory of 1732	2228	rundll32.exe	28
PID 2228 wrote to memory of 1732	2228	rundll32.exe	28
PID 2228 wrote to memory of 1732	2228	rundll32.exe	28
PID 2228 wrote to memory of 1732	2228	rundll32.exe	28
PID 2228 wrote to memory of 1732	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2987bb711165f62831e9da5ffcfed9b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2987bb711165f62831e9da5ffcfed9b0_NeikiAnalytics.dll,#1
  2⤵
  PID:1732