7b3b4a0f0630c181ef9946f9e126eab8409852465bd927e56cc8baa2f42a61ea

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 02:34

Target

5ada8dfbcb09fdbfc36ba78eed788f00_NeikiAnalytics.dll
Size

6KB
MD5

5ada8dfbcb09fdbfc36ba78eed788f00
SHA1

e118f5d6c12b5ffd40d9ff82b15f04c0c7ee48e9
SHA256

7b3b4a0f0630c181ef9946f9e126eab8409852465bd927e56cc8baa2f42a61ea
SHA512

9eb5986baa2e24cec8d587519dbbcf91e6d0f9de1ba4c8d07c07b8f559c2684e59546d0e8e573b7b799e735b11a26440425dbd0921ee97fe5ed849c8a13726d5
SSDEEP

96:hy859x0P8MaQakYTLdvc+5ijuYeMluXVp7/:F5oLda91cUijuUlun7/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2080	1252	rundll32.exe	28
PID 1252 wrote to memory of 2080	1252	rundll32.exe	28
PID 1252 wrote to memory of 2080	1252	rundll32.exe	28
PID 1252 wrote to memory of 2080	1252	rundll32.exe	28
PID 1252 wrote to memory of 2080	1252	rundll32.exe	28
PID 1252 wrote to memory of 2080	1252	rundll32.exe	28
PID 1252 wrote to memory of 2080	1252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ada8dfbcb09fdbfc36ba78eed788f00_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ada8dfbcb09fdbfc36ba78eed788f00_NeikiAnalytics.dll,#1
  2⤵
  PID:2080