8a637a9df4169655c25de985dda88817056ec5a6ed202ff119a11bce769789d7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 03:01

Target

61afb625371660015e8997f967a3df00_NeikiAnalytics.dll
Size

1.1MB
MD5

61afb625371660015e8997f967a3df00
SHA1

bb57303a97e841e13efe1c1c690fb0058c7c1a95
SHA256

8a637a9df4169655c25de985dda88817056ec5a6ed202ff119a11bce769789d7
SHA512

6d363138f2791319fd115136e01a84c2c7cf7a68e33b7cac2042372262e9866898040056adab31eb5a6a3579d6aa769560c0129967ab70d9962c873f477e738d
SSDEEP

24576:9RmTfm3BiDnRWyUtjjsAT4gEcqXrwmQ4r/RnnuTYZcJfw5XrEH7f:aTeQDRWyUtjjiEn4rxuTQcJf4C

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61afb625371660015e8997f967a3df00_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61afb625371660015e8997f967a3df00_NeikiAnalytics.dll,#1
  2⤵
  PID:2784