84006d8bdfa38396d65539083cef26bbbf5358a9237f7479554b77b1aedf959e

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 22:12

Target

435ae5670a7bc4ebc64e267fc28ba870_NeikiAnalytics.dll
Size

81KB
MD5

435ae5670a7bc4ebc64e267fc28ba870
SHA1

8b1bbe892b43e5e5f62305c17ee2e111224b7c40
SHA256

84006d8bdfa38396d65539083cef26bbbf5358a9237f7479554b77b1aedf959e
SHA512

f6cac4f350b2ee9c12e0177a1ad9f70a8369e0e58220996594d9aac18e50714c62f256a8ad0326d02c924a7ce944c84e10c4142dea5988cd358b77c48d17bdc9
SSDEEP

1536:QtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wj:Q4v4JKXTx71w0ArSsXF3enq8Wj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1648 wrote to memory of 2032	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 2032	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 2032	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 2032	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 2032	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 2032	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 2032	1648	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\435ae5670a7bc4ebc64e267fc28ba870_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\435ae5670a7bc4ebc64e267fc28ba870_NeikiAnalytics.dll,#1
2⤵
PID:2032