40dbbedf6de2e9ee414d6a88fe8baf09afbcf06cd6da0a95d5b473eba765235e

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 02:20

Target

4af94bb25b992af4c1941265a2f705b0_NeikiAnalytics.dll
Size

81KB
MD5

4af94bb25b992af4c1941265a2f705b0
SHA1

5b9a4c8f6163633b50aab5270f68f94a9a4e4d78
SHA256

40dbbedf6de2e9ee414d6a88fe8baf09afbcf06cd6da0a95d5b473eba765235e
SHA512

bebacadc9c8dac114a768e4471172a3b0a56152f5370953b688bd227e600b3c12da1a9713cca4e9478448d34e150a1a1b063433a732bc050d48cd6d34f1569ae
SSDEEP

1536:cByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8WA:Zv4JKXTx71wnArSsXFpeXq8WA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4af94bb25b992af4c1941265a2f705b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4af94bb25b992af4c1941265a2f705b0_NeikiAnalytics.dll,#1
  2⤵
  PID:640