d14535d61fec83d1872b1ade1574898498fc06422e286880cc35fea3e1c87f2c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 23:44

Target

4b307f8dd8614a3159202a431a23c550_NeikiAnalytics.dll
Size

81KB
MD5

4b307f8dd8614a3159202a431a23c550
SHA1

c39d56a2f7c4319e6003143c0025f939f327742e
SHA256

d14535d61fec83d1872b1ade1574898498fc06422e286880cc35fea3e1c87f2c
SHA512

f75ac6579bf89e9bc47449e87a429f85311a359e9381841bd80d49ea3487bf59c400c5477736d96e88ce0d03263ea7809c13e98d0b3b5a34d3f2c9dfdbaf8a7b
SSDEEP

1536:+tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WF:+4v4JKXTx71w0ArSsXF3enq8WF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b307f8dd8614a3159202a431a23c550_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b307f8dd8614a3159202a431a23c550_NeikiAnalytics.dll,#1
  2⤵
  PID:1708