f4ccdba51038be1b7322ea97f93e8a9d64b153b7ea54a84510f3e275ada1d218

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 13:07

Target

124e9a3a4c0657bfe8be3832704529c0_NeikiAnalytics.dll
Size

1.2MB
MD5

124e9a3a4c0657bfe8be3832704529c0
SHA1

fa27156d2a08b8488c9274db2b68203434e3e3f1
SHA256

f4ccdba51038be1b7322ea97f93e8a9d64b153b7ea54a84510f3e275ada1d218
SHA512

124da13d7b8985b23e478aa1a5fe4df5926955ea0c8e9a270cd8be8d9137edf69d63ca0e10cafc51af4881a8a0b4e2d2303e8ea8557ef4f1511c2c2aa5759e82
SSDEEP

12288:Jhpp7/+mGc6pD1cUxIrhA4PIYKvN9OcsduwVID79gOftpP+uTAu/BSLzM4LacGzn:kp0LqanWRK+YZekqWBXQZe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2504	2884	rundll32.exe	28
PID 2884 wrote to memory of 2504	2884	rundll32.exe	28
PID 2884 wrote to memory of 2504	2884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\124e9a3a4c0657bfe8be3832704529c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2884 -s 168
  2⤵
  PID:2504