0047f095162b002d3de2b3c2219f2d491f5546872edbdcccf9f1ebf87b79e9fb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 13:20

Target

b9d9dd24718a658796d44ed03217ee70_NeikiAnalytics.dll
Size

7KB
MD5

b9d9dd24718a658796d44ed03217ee70
SHA1

e459e1d65f0aaa42c3b6f13788dad7991791c735
SHA256

0047f095162b002d3de2b3c2219f2d491f5546872edbdcccf9f1ebf87b79e9fb
SHA512

f1d5e1987b152607a8e36c9a9538091c502a8b971ce4ada7c33895392f9eba3e0c7ae8d03775426dd8a21e8e0d1284f590c6344f33115751fabd83ed9865ec68
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWabABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPcq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9d9dd24718a658796d44ed03217ee70_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9d9dd24718a658796d44ed03217ee70_NeikiAnalytics.dll,#1
  2⤵
  PID:2172