f5a90e7990ea3121360e4be43ec3b237cfda60bd484aee232a79e56b9d7d8e58

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 16:57

Target

31aafcbf6540c62ec1d9e22cc7c43010_NeikiAnalytics.dll
Size

6KB
MD5

31aafcbf6540c62ec1d9e22cc7c43010
SHA1

779ef61417ff3c04e854d877bd3c4353caefec7d
SHA256

f5a90e7990ea3121360e4be43ec3b237cfda60bd484aee232a79e56b9d7d8e58
SHA512

5c148abf8262a823c189e73d62d4bfff14563468f2b2c7bf6af976c7164fcd9fd2a66559fd424b827564c243b1861463dfc345ea22a70c3b978672e9ba716287
SSDEEP

96:nEY2RrF1eqwi47cq7hMbPT/eoJiCnzqRN8T+p/GsgJE/J:EHRh1epp57SbPT/eaiCzqRN8CpOsU8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2228	2700	rundll32.exe	28
PID 2700 wrote to memory of 2228	2700	rundll32.exe	28
PID 2700 wrote to memory of 2228	2700	rundll32.exe	28
PID 2700 wrote to memory of 2228	2700	rundll32.exe	28
PID 2700 wrote to memory of 2228	2700	rundll32.exe	28
PID 2700 wrote to memory of 2228	2700	rundll32.exe	28
PID 2700 wrote to memory of 2228	2700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31aafcbf6540c62ec1d9e22cc7c43010_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31aafcbf6540c62ec1d9e22cc7c43010_NeikiAnalytics.dll,#1
  2⤵
  PID:2228