1a9dda6b997b8eb3d8e3a5a0773c5b4cec2055a5875f08514cd1da716ccbec5c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 07:00

Target

7a835fcb3634413c1c74c605acdc2f20_NeikiAnalytics.dll
Size

81KB
MD5

7a835fcb3634413c1c74c605acdc2f20
SHA1

d0063be3fe54031cfd5096e141a4c98fdfb94b90
SHA256

1a9dda6b997b8eb3d8e3a5a0773c5b4cec2055a5875f08514cd1da716ccbec5c
SHA512

85d95c138162e448d24c4b4c32b52c5e3152710a5c3aaf9058ff8fab9f70cb4d3adfd1083407facd573a38094c0bf9cb7003da04fee0958942c3a3ea65320dcc
SSDEEP

1536:ntByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8W0:n4v4JKXTx71w0ArSsXF3enq8W0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2612	1432	rundll32.exe	28
PID 1432 wrote to memory of 2612	1432	rundll32.exe	28
PID 1432 wrote to memory of 2612	1432	rundll32.exe	28
PID 1432 wrote to memory of 2612	1432	rundll32.exe	28
PID 1432 wrote to memory of 2612	1432	rundll32.exe	28
PID 1432 wrote to memory of 2612	1432	rundll32.exe	28
PID 1432 wrote to memory of 2612	1432	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a835fcb3634413c1c74c605acdc2f20_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a835fcb3634413c1c74c605acdc2f20_NeikiAnalytics.dll,#1
  2⤵
  PID:2612