f851b72ad763e91806d868975f8976c0e10d6189b123720b903ff687c65d5641

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 22:57

Target

4d21f7527b37dbf5ceb4c895270700c0_NeikiAnalytics.dll
Size

5KB
MD5

4d21f7527b37dbf5ceb4c895270700c0
SHA1

0492fb001ebf7733f93214bf602fa19739d44de6
SHA256

f851b72ad763e91806d868975f8976c0e10d6189b123720b903ff687c65d5641
SHA512

29ea78a258da2e4e9153767fb8b6417f6fd8e4e109b4b7b07cd301623d337c8bd385d671a8e2e426c70b97f0ced38b15938dc1cefdeb0689210c74ea117300c9
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXraSbpTh:1h9jTqMMrY0OI/KYyznSM20Nh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2608	2208	rundll32.exe	28
PID 2208 wrote to memory of 2608	2208	rundll32.exe	28
PID 2208 wrote to memory of 2608	2208	rundll32.exe	28
PID 2208 wrote to memory of 2608	2208	rundll32.exe	28
PID 2208 wrote to memory of 2608	2208	rundll32.exe	28
PID 2208 wrote to memory of 2608	2208	rundll32.exe	28
PID 2208 wrote to memory of 2608	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d21f7527b37dbf5ceb4c895270700c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d21f7527b37dbf5ceb4c895270700c0_NeikiAnalytics.dll,#1
  2⤵
  PID:2608