3d7494db8d5b0141f1207e83c7e6e087b3a85e20591481f4aaa0525f970c0686

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 07:15

Target

a4ef6f17ff7286eae3ffffe34617af80_NeikiAnalytics.dll
Size

48KB
MD5

a4ef6f17ff7286eae3ffffe34617af80
SHA1

bcb6fcc539abefc176e96553727c4e00cbc35e20
SHA256

3d7494db8d5b0141f1207e83c7e6e087b3a85e20591481f4aaa0525f970c0686
SHA512

27555e8cbd2a55caba423c25a0d64ee8fe9f4ea96e25b607d5037d7b4ec577476f1efad74d71136feef2bd98b687fd3bdcbd3836d357567b29da548393b2433a
SSDEEP

768:YL1FsvFlT5uETSvgunPiNHttWBjBEON5QzAqZuoC:YL1uTUETIgEaNNoEOnnJo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	2984	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 2984 wrote to memory of 2852	2984	rundll32.exe	29
PID 2984 wrote to memory of 2852	2984	rundll32.exe	29
PID 2984 wrote to memory of 2852	2984	rundll32.exe	29
PID 2984 wrote to memory of 2852	2984	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4ef6f17ff7286eae3ffffe34617af80_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4ef6f17ff7286eae3ffffe34617af80_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 224
    3⤵
    - Program crash
    PID:2852