62e6f910235ee5da90eae42873ad924ffcd12acd7951eb74d945835110bef6f8

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 10:49

Target

c396834bb3fe958986f3f8821380e3d0_NeikiAnalytics.dll
Size

342KB
MD5

c396834bb3fe958986f3f8821380e3d0
SHA1

c64ae612d6e73e7dd2ed44a3a5cbc2189b735e24
SHA256

62e6f910235ee5da90eae42873ad924ffcd12acd7951eb74d945835110bef6f8
SHA512

4d9df644d7c554b602a66e921253a106f463807c1135bad2b7f2c1e66a92ef8bc7d361e9b7d4ef5ef214788d21f2fddad9a7fe0561e60969380cd67c6d9b214f
SSDEEP

6144:cRoOpXN8bEvZehNyi5qlscXsKCkSLjn7WQDilmvWpJJvEi3:cRoOpXCjNwlscXeJikilmvYEi3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c396834bb3fe958986f3f8821380e3d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c396834bb3fe958986f3f8821380e3d0_NeikiAnalytics.dll,#1
  2⤵
  PID:1056