51cba2b9ecc1513a10cafdeb6030c665b1b8d1ae2a1b3fabb58ff2e946a4cbfe

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 13:57

Target

c95d35b059c5cd5de78d0eeeeaa274f0_NeikiAnalytics.dll
Size

6KB
MD5

c95d35b059c5cd5de78d0eeeeaa274f0
SHA1

56c4e1f19fd4dc1ee7eb94ab0224aa82d3a981de
SHA256

51cba2b9ecc1513a10cafdeb6030c665b1b8d1ae2a1b3fabb58ff2e946a4cbfe
SHA512

585889f25641b35db1ecd5458e446f9d7e3386aa49712fecbd5b4294ac96c72b9007331d41013790fca91842a7d9be00fec8ecd32a8f7c9b6289eb986e739f08
SSDEEP

48:SsGp63gAST0cMLlD7prUlG9Nzg72mSyl+ONSgZR+AReMH:VGEETrMLH5QBSylRSuR+AReM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c95d35b059c5cd5de78d0eeeeaa274f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c95d35b059c5cd5de78d0eeeeaa274f0_NeikiAnalytics.dll,#1
  2⤵
  PID:1516