869c4dbeefeac0b8504d8809474f218936116a3c1451bec815b32c191a10fd57

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 19:53

Target

5ebdcc32688e8e265b03a298c91d3940_NeikiAnalytics.dll
Size

47KB
MD5

5ebdcc32688e8e265b03a298c91d3940
SHA1

092a62b120bd2d015e8cc450b9d80d74e1434d1c
SHA256

869c4dbeefeac0b8504d8809474f218936116a3c1451bec815b32c191a10fd57
SHA512

85e11588a00b0f3733de4929fd30426d8246cf2d26919ada58faf65acdabd89e720fa94a0fcc43a4ba10c121b755609dfa34815913ac10ba96d096483ce3a8e6
SSDEEP

768:7/MKPffDs+TiCAwlQ0oGTaatgrk14LTMR071q/dAYAPP:7bfw+wwlQbatRR071q/dtAPP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ebdcc32688e8e265b03a298c91d3940_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ebdcc32688e8e265b03a298c91d3940_NeikiAnalytics.dll,#1
  2⤵
  PID:2388