d56ca5d98de470f31f1bf4810b9d0250859cb92e1287a67d239099e2124e3487

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 11:46

Target

d643f8da31d077445b1838e0c479f780_NeikiAnalytics.dll
Size

1.6MB
MD5

d643f8da31d077445b1838e0c479f780
SHA1

fb04e1a1901696c892e5bbd84a5d15427ce20450
SHA256

d56ca5d98de470f31f1bf4810b9d0250859cb92e1287a67d239099e2124e3487
SHA512

3057f08eb9c33bc9da6b383c3c0af48196a93b73e2088765d508ff7d1109a70c5207f454ed3ac31ee6f045e154a0d2bdb1126049670669f00da2db66c712af23
SSDEEP

12288:zJ1wJCKvWHJ4+SQFzeJqBh2nruzYqPaFyak8R1UyRK805fB7PX4e50W0jRYMhd4E:NaqtSQ0q8ruMni0Vq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1812	2172	rundll32.exe	28
PID 2172 wrote to memory of 1812	2172	rundll32.exe	28
PID 2172 wrote to memory of 1812	2172	rundll32.exe	28
PID 2172 wrote to memory of 1812	2172	rundll32.exe	28
PID 2172 wrote to memory of 1812	2172	rundll32.exe	28
PID 2172 wrote to memory of 1812	2172	rundll32.exe	28
PID 2172 wrote to memory of 1812	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d643f8da31d077445b1838e0c479f780_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d643f8da31d077445b1838e0c479f780_NeikiAnalytics.dll,#1
  2⤵
  PID:1812