aa38986a5ed7b51f58c86637f411ead5498b6faefcb21c0da41222ad5be14617

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 17:20

Target

bf83ce2d241c12a05a8152184e18ae10_NeikiAnalytics.dll
Size

1.6MB
MD5

bf83ce2d241c12a05a8152184e18ae10
SHA1

e70e38fa04c43f2b9496d40ac610226ab8b82f78
SHA256

aa38986a5ed7b51f58c86637f411ead5498b6faefcb21c0da41222ad5be14617
SHA512

309dea235ccd88d330ff4abd92e0ba3082470b6dd3d1590c0c7a717fdc4850ace38ad1b0ee6e9517cc55b29f6f6abc975a5703820d6627505ec2dc6bd61f78ff
SSDEEP

24576:ESigvwL2ctDMjo5Aku347FWyVdEOLInqy:ZUBQs434/en1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	1932	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1932	2008	rundll32.exe	28
PID 2008 wrote to memory of 1932	2008	rundll32.exe	28
PID 2008 wrote to memory of 1932	2008	rundll32.exe	28
PID 2008 wrote to memory of 1932	2008	rundll32.exe	28
PID 2008 wrote to memory of 1932	2008	rundll32.exe	28
PID 2008 wrote to memory of 1932	2008	rundll32.exe	28
PID 2008 wrote to memory of 1932	2008	rundll32.exe	28
PID 1932 wrote to memory of 2732	1932	rundll32.exe	29
PID 1932 wrote to memory of 2732	1932	rundll32.exe	29
PID 1932 wrote to memory of 2732	1932	rundll32.exe	29
PID 1932 wrote to memory of 2732	1932	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf83ce2d241c12a05a8152184e18ae10_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf83ce2d241c12a05a8152184e18ae10_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 272
    3⤵
    - Program crash
    PID:2732

memory/1932-0-0x00000000008C0000-0x0000000000A67000-memory.dmp

Filesize
1.7MB

Download
memory/1932-1-0x00000000008C0000-0x0000000000A67000-memory.dmp

Filesize
1.7MB

Download