b3e7d0103d923d5a8b708d5bf78b7683257031fca6622e979f2c449e84184736

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 03:43

Target

71f25aa61d0df33d3cb2116df548f090_NeikiAnalytics.dll
Size

158KB
MD5

71f25aa61d0df33d3cb2116df548f090
SHA1

1a4ced5d3ba2bcca706e4207666729cb90f20571
SHA256

b3e7d0103d923d5a8b708d5bf78b7683257031fca6622e979f2c449e84184736
SHA512

127cc4cb0c721d3b0014e517571c8199af0c0e48aa7e39d6be6abd4641a86acecd4e4cf690d98616a1aa18b623231ccd8f28fdcfee3f700bded64858d5a08be2
SSDEEP

3072:OvyyMt+ogFsbmlphvQp1h1APp+4qsKoSAfajTMxkXlJRxNeev7Gg:OqBc1DhvQDjYcATa/MOXDdeC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2528	2060	rundll32.exe	28
PID 2060 wrote to memory of 2528	2060	rundll32.exe	28
PID 2060 wrote to memory of 2528	2060	rundll32.exe	28
PID 2060 wrote to memory of 2528	2060	rundll32.exe	28
PID 2060 wrote to memory of 2528	2060	rundll32.exe	28
PID 2060 wrote to memory of 2528	2060	rundll32.exe	28
PID 2060 wrote to memory of 2528	2060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71f25aa61d0df33d3cb2116df548f090_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71f25aa61d0df33d3cb2116df548f090_NeikiAnalytics.dll,#1
  2⤵
  PID:2528