8387e978272538ad190f1d78996b9dee496418fb8b687f83076b6bf92e673163

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 17:21

Target

bf8c3f39d7c8e347441ad880d3ceb880_NeikiAnalytics.dll
Size

5KB
MD5

bf8c3f39d7c8e347441ad880d3ceb880
SHA1

8fe19bdf8e49eb15e63b7799185525acb70f5a7b
SHA256

8387e978272538ad190f1d78996b9dee496418fb8b687f83076b6bf92e673163
SHA512

97d82af24757d6b59491f8c574e9bd92fd61a74a175aac77b63712e9329f1d4ea2d167dc1f5da95b3d0f9372e424792a763e7af31f0fad93c5252e5eb7a885af
SSDEEP

48:SASAl6a98rtNVhWOZU8tOZGKs3JUFOIRiee/SY2qkUcHPuq6DcJ1Ta0bS:f8rv2OZVtOZds3OFOIRxe/hSU0UO1Te

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	1748	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1748 wrote to memory of 2308	1748	rundll32.exe	29
PID 1748 wrote to memory of 2308	1748	rundll32.exe	29
PID 1748 wrote to memory of 2308	1748	rundll32.exe	29
PID 1748 wrote to memory of 2308	1748	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf8c3f39d7c8e347441ad880d3ceb880_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf8c3f39d7c8e347441ad880d3ceb880_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 228
    3⤵
    - Program crash
    PID:2308