aee2a24f237559599e9e93739e97b102ca85fd4807efc9390cf9e8cb90f21a79

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 13:27

Target

14fccc90a53f7dd9b9874282d5cdd420_NeikiAnalytics.dll
Size

81KB
MD5

14fccc90a53f7dd9b9874282d5cdd420
SHA1

a49f0280d68af2e5f347b6d814bb5ad6b2ded63f
SHA256

aee2a24f237559599e9e93739e97b102ca85fd4807efc9390cf9e8cb90f21a79
SHA512

178e3dd035faebef83b61f087f3299f1a05ac69b34b32f62934615dd4bb729cf037b279eb7f8ae8bbc8a4cd94cfda822005835596341a25d35f5eba21582283a
SSDEEP

1536:htByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wd:h4v4JKXTx71w0ArSsXF3enq8Wd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14fccc90a53f7dd9b9874282d5cdd420_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14fccc90a53f7dd9b9874282d5cdd420_NeikiAnalytics.dll,#1
  2⤵
  PID:1784