f14c25efeb81bc8ed61d36c478c9244002fa4b4ea42609fd2f9e8505f7f94fbd

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 18:17

Target

3ce91db099215e64525123ac8c405010_NeikiAnalytics.dll
Size

100KB
MD5

3ce91db099215e64525123ac8c405010
SHA1

8c5d8c2016b4f2db47d1eafbb8d2a5532b76669b
SHA256

f14c25efeb81bc8ed61d36c478c9244002fa4b4ea42609fd2f9e8505f7f94fbd
SHA512

257f87629dcd9ecde8ceb54faa4bdb78a3ae7bf4d856b682007f21ad83ccdbdc8f44e42b1097faecd719dca56614ef9851ab937e29728c13aca5d6446623d1d9
SSDEEP

3072:GYnITrTeQ7xIFt/6gd7QCxW/9kLtgpYkgPl:ETrTeQ7ayIQCxq9xYP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2036	2192	rundll32.exe	28
PID 2192 wrote to memory of 2036	2192	rundll32.exe	28
PID 2192 wrote to memory of 2036	2192	rundll32.exe	28
PID 2192 wrote to memory of 2036	2192	rundll32.exe	28
PID 2192 wrote to memory of 2036	2192	rundll32.exe	28
PID 2192 wrote to memory of 2036	2192	rundll32.exe	28
PID 2192 wrote to memory of 2036	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ce91db099215e64525123ac8c405010_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ce91db099215e64525123ac8c405010_NeikiAnalytics.dll,#1
  2⤵
  PID:2036