8c5ea0e3ecce3a2cc93f2c32dcd262c4ce5b967c2f0ec4ed92075d917d5962d1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 20:54

Target

5a2793832fb8bb64925870a580293ba0_NeikiAnalytics.dll
Size

360KB
MD5

5a2793832fb8bb64925870a580293ba0
SHA1

91f7623432b66b6e22db648707214669ef172a5d
SHA256

8c5ea0e3ecce3a2cc93f2c32dcd262c4ce5b967c2f0ec4ed92075d917d5962d1
SHA512

2657d3c1a75cc4b125773a70487701c158631abcab0d825e7c66005f26181ef305058c0d1e500e62853e2f453e18d55c24f36a0655f94e046db21aa1b9cfa2da
SSDEEP

6144:xsubohDCssG3LAUul99UM8KDBuvWtuj2XMSV0L0huFUNpNNepnsOpXKkA1b:PmCssG75ul99sEBSWtM2JqL0huFULNNl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2644	3000	rundll32.exe	28
PID 3000 wrote to memory of 2644	3000	rundll32.exe	28
PID 3000 wrote to memory of 2644	3000	rundll32.exe	28
PID 3000 wrote to memory of 2644	3000	rundll32.exe	28
PID 3000 wrote to memory of 2644	3000	rundll32.exe	28
PID 3000 wrote to memory of 2644	3000	rundll32.exe	28
PID 3000 wrote to memory of 2644	3000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a2793832fb8bb64925870a580293ba0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a2793832fb8bb64925870a580293ba0_NeikiAnalytics.dll,#1
  2⤵
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\1A92.tmp
    C:\Users\Admin\AppData\Local\Temp\1A92.tmp
    3⤵
    PID:2944

memory/2644-1-0x0000000000200000-0x000000000023A000-memory.dmp

Filesize
232KB

Download
memory/2644-0-0x0000000000200000-0x000000000023A000-memory.dmp

Filesize
232KB

Download