0238ae385b9b4f6e2eab8ee039deaed53ca6b9fe05b7bf2c0a3685c0d286ffc3

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 13:21

Target

b9ebdac5cbcb66e90de6ca388d919db0_NeikiAnalytics.dll
Size

6KB
MD5

b9ebdac5cbcb66e90de6ca388d919db0
SHA1

292b1ab27c6d6423bc3615fea5933296303d1378
SHA256

0238ae385b9b4f6e2eab8ee039deaed53ca6b9fe05b7bf2c0a3685c0d286ffc3
SHA512

7ad0cf950b68d370c7a5bbf0841796e7fc2807fe335d6c350c4b34b46049f4a453c489a2347921440e0f326a0123dc54fca0cee090e2da198acdd2727d72c096
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD7hiov:nGTWJGp0UZUd6378snt7v

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9ebdac5cbcb66e90de6ca388d919db0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9ebdac5cbcb66e90de6ca388d919db0_NeikiAnalytics.dll,#1
  2⤵
  PID:2660