8a6073d8789fe50df74dcaaf6eb0e5e6d9e7451b042b84ec567ae0aa5015f642

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 18:56

Target

42d3f28ed4a91a904b99ea74574ca230_NeikiAnalytics.dll
Size

4KB
MD5

42d3f28ed4a91a904b99ea74574ca230
SHA1

ecfbb576cd977f3f744e0a6adc984b5272d4d4e3
SHA256

8a6073d8789fe50df74dcaaf6eb0e5e6d9e7451b042b84ec567ae0aa5015f642
SHA512

192205cacf19a2b56c5e93ac6a8e1c8fb016e0e5d1a9f7bb82bb1667f405a2b97121b9c531cc2d482f7e4b05d2a930b03177a1bb945b50d3fb5aba1d12bcdbcb
SSDEEP

48:SeO0HoVTnXz+isZjIr0LT9wfsj845BFLx3rHO4yThn2:2TnXzyIIP9H84fHbXV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42d3f28ed4a91a904b99ea74574ca230_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42d3f28ed4a91a904b99ea74574ca230_NeikiAnalytics.dll,#1
  2⤵
  PID:2472