3e3a80cff0fc34c60082bc2c5b918756c674a7a48e645a043a707c7fda7a8e9c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 14:02

Target

c99100f88ab4325c93e7a867fbab80c0_NeikiAnalytics.dll
Size

140KB
MD5

c99100f88ab4325c93e7a867fbab80c0
SHA1

69edb173d819f4746ffd079c050d30fddbb9e6fb
SHA256

3e3a80cff0fc34c60082bc2c5b918756c674a7a48e645a043a707c7fda7a8e9c
SHA512

74858acc8f16dc026ff5765a9d4dd87cd0bf1baa3dd022cfae1eb5cffa740fa65f8a5449201475bfffbbf55d47e5646daa5315700d09487c843166f9d5f21d3e
SSDEEP

3072:1S98J2VMmDhjYt1YD+TRK2U/Blg/+LUaFNWNjE9P7ObKN:148JkXhj6Xs225LUWNWNjE9yb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1952	2924	rundll32.exe	28
PID 2924 wrote to memory of 1952	2924	rundll32.exe	28
PID 2924 wrote to memory of 1952	2924	rundll32.exe	28
PID 2924 wrote to memory of 1952	2924	rundll32.exe	28
PID 2924 wrote to memory of 1952	2924	rundll32.exe	28
PID 2924 wrote to memory of 1952	2924	rundll32.exe	28
PID 2924 wrote to memory of 1952	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99100f88ab4325c93e7a867fbab80c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99100f88ab4325c93e7a867fbab80c0_NeikiAnalytics.dll,#1
  2⤵
  PID:1952

memory/1952-0-0x0000000000140000-0x0000000000169000-memory.dmp

Filesize
164KB

Download