cbd2c5e2c717eaa1d5d71f088d393fc7ba1f7738236efcaadc6805294c4ae527

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 12:34

Target

03a6ec40da215ed517972b0af6dcf290_NeikiAnalytics.dll
Size

81KB
MD5

03a6ec40da215ed517972b0af6dcf290
SHA1

49927f243195c048d1d17ea5d36e92d001c316b1
SHA256

cbd2c5e2c717eaa1d5d71f088d393fc7ba1f7738236efcaadc6805294c4ae527
SHA512

6a9a9244f6ccc1b0402e829945a148a93958a3f2c9b7dadf879346eaab278e494f085a1b33ece02571422baed568a6d8fd5c4a8bba51b25ae8ac31b2ff1ad901
SSDEEP

1536:ttByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WO:t4v4JKXTx71w0ArSsXF3enq8WO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03a6ec40da215ed517972b0af6dcf290_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03a6ec40da215ed517972b0af6dcf290_NeikiAnalytics.dll,#1
  2⤵
  PID:2812