28e0283586bec633962cf41b0820101dbf69b3e814805632763e18a07eeb3b19

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 02:47

Target

5ebe85dc9ca049ebccec39345ef4a570_NeikiAnalytics.dll
Size

81KB
MD5

5ebe85dc9ca049ebccec39345ef4a570
SHA1

f0e52c3cbf4a61a9aec26599db997bf3ccf2b861
SHA256

28e0283586bec633962cf41b0820101dbf69b3e814805632763e18a07eeb3b19
SHA512

1e0790255dd4af1ec0ecaf4de19f4899c1efd8658b0a17cd2d5b22758c6a6c2047338d2003efc7b588f122cbfd8b929c930d0bfc495e903cfc4593e9b05ab5b2
SSDEEP

1536:TtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WD:T4v4JKXTx71w0ArSsXF3enq8WD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2848	2268	rundll32.exe	28
PID 2268 wrote to memory of 2848	2268	rundll32.exe	28
PID 2268 wrote to memory of 2848	2268	rundll32.exe	28
PID 2268 wrote to memory of 2848	2268	rundll32.exe	28
PID 2268 wrote to memory of 2848	2268	rundll32.exe	28
PID 2268 wrote to memory of 2848	2268	rundll32.exe	28
PID 2268 wrote to memory of 2848	2268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ebe85dc9ca049ebccec39345ef4a570_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ebe85dc9ca049ebccec39345ef4a570_NeikiAnalytics.dll,#1
  2⤵
  PID:2848