3abf99f1054f4ea921321f10556a6558db422bd78a4cd690dd4c083537bed236

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 17:01

Target

ce736fea196cea497fcb03394ccd6ee0_NeikiAnalytics.dll
Size

697KB
MD5

ce736fea196cea497fcb03394ccd6ee0
SHA1

c351f6220b88f5bfdc9d46d77a455a5c8640bb80
SHA256

3abf99f1054f4ea921321f10556a6558db422bd78a4cd690dd4c083537bed236
SHA512

b17857de74f5d6d7870b7b129e2798c6eb45d4855e27ec498b45054753cce6fef822c63b797915ea8468a4f69d2c66ff32ba288c85a722bee5b1147f15b5483d
SSDEEP

12288:vZJbsyj0hDirsRdjNPxMOz+x7IlXTw05nmZfRR8BU:vZJQA0hWrsRdjN5MOz+x7IOAmZfR2u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2024	1664	rundll32.exe	28
PID 1664 wrote to memory of 2024	1664	rundll32.exe	28
PID 1664 wrote to memory of 2024	1664	rundll32.exe	28
PID 1664 wrote to memory of 2024	1664	rundll32.exe	28
PID 1664 wrote to memory of 2024	1664	rundll32.exe	28
PID 1664 wrote to memory of 2024	1664	rundll32.exe	28
PID 1664 wrote to memory of 2024	1664	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce736fea196cea497fcb03394ccd6ee0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce736fea196cea497fcb03394ccd6ee0_NeikiAnalytics.dll,#1
  2⤵
  PID:2024