beb4202b039750ebc631a7ab2f8e86e29d9dbadf326389df6ebee44c3603c31d

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 16:27

Target

1ab5aafde8e58dcb7008c2e53d819090_NeikiAnalytics.dll
Size

29KB
MD5

1ab5aafde8e58dcb7008c2e53d819090
SHA1

1282a655d825f7c41a95d1be28411a17dbb8883b
SHA256

beb4202b039750ebc631a7ab2f8e86e29d9dbadf326389df6ebee44c3603c31d
SHA512

0373fbd4ec1e69f383354a4543534ec3fb2f00d7e047e3f97d4b305aada6737c3c8b86b62ed3657ecb4d6ea6f530dc048df4e32a5f0c706374ade6b630c2f0da
SSDEEP

384:ESJvA6xTf+sEGkt/dPf9tb1+RVwLDXe5c5YQpCVT6kJNxj4odebjubw+T0PUYTQV:nxTpw9aVwLDXH6w06kvGosby6cpcX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 1732	2712	rundll32.exe	28
PID 2712 wrote to memory of 1732	2712	rundll32.exe	28
PID 2712 wrote to memory of 1732	2712	rundll32.exe	28
PID 2712 wrote to memory of 1732	2712	rundll32.exe	28
PID 2712 wrote to memory of 1732	2712	rundll32.exe	28
PID 2712 wrote to memory of 1732	2712	rundll32.exe	28
PID 2712 wrote to memory of 1732	2712	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ab5aafde8e58dcb7008c2e53d819090_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ab5aafde8e58dcb7008c2e53d819090_NeikiAnalytics.dll,#1
  2⤵
  PID:1732