46e67d4da9152ce3fc6c494e524a1ed33a31e3746df358308cd22d1b8af007d9

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 04:41

Target

7f9f2acc4461aa1ed487c8f99249b7a0_NeikiAnalytics.dll
Size

208KB
MD5

7f9f2acc4461aa1ed487c8f99249b7a0
SHA1

ce99b1471fe8a0ee54761d5e9c4522ac3c000ee2
SHA256

46e67d4da9152ce3fc6c494e524a1ed33a31e3746df358308cd22d1b8af007d9
SHA512

2de05fafbb8108c70f9b6eb614b2dabee4bc384bb7af2d63011ec46781d076cc416875b0562c943618cfd11ddc38e231f96fdf7c435368d559eb2137f2fa51ce
SSDEEP

3072:GgA90Z9u2rF7hngtehW4bUb5VwwkOIO8eMB+z53mLrDDAVOEneDpLx+ul1TUusqL:GZ6IKF14MUb5PhD5krDsEKedUuj7se

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f9f2acc4461aa1ed487c8f99249b7a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f9f2acc4461aa1ed487c8f99249b7a0_NeikiAnalytics.dll,#1
  2⤵
  PID:2164

memory/2164-0-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/2164-2-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/2164-1-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download