9017124249263a19d2e1bd7e9ddfa755f0cdcdc2222cd2a3afd6702aef303959

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 16:13

Target

2bfbc8bafa9d2b8a5108c6a58c0b28f0_NeikiAnalytics.dll
Size

128KB
MD5

2bfbc8bafa9d2b8a5108c6a58c0b28f0
SHA1

698f8a450921eb7e4e4516a0e590614882fca319
SHA256

9017124249263a19d2e1bd7e9ddfa755f0cdcdc2222cd2a3afd6702aef303959
SHA512

f88daa922c27ba6e4fa2fa134e006dcfda0ce2d959dc6902d607978ca90d5073f45efe4a5e9d1cdbbd11b0eee49fb92c6743c50b006c467ff01caed74624fcec
SSDEEP

3072:CMWSGmj6LQuvm2xTKnKSkE5tRoUVFr2Jb:Z4Qgm2xTOKSzVeb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bfbc8bafa9d2b8a5108c6a58c0b28f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bfbc8bafa9d2b8a5108c6a58c0b28f0_NeikiAnalytics.dll,#1
  2⤵
  PID:1736

memory/1736-0-0x00000000000C0000-0x00000000000E8000-memory.dmp

Filesize
160KB

Download