94c39ce543aea6118bb09943078b412282142609d5b2836d054ac4bae991354b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 23:50

Target

59ab640b53d772fec9e88db64c5dec00_NeikiAnalytics.dll
Size

81KB
MD5

59ab640b53d772fec9e88db64c5dec00
SHA1

5c3595a634cb61b9f87854c29542ec244fe9f4f7
SHA256

94c39ce543aea6118bb09943078b412282142609d5b2836d054ac4bae991354b
SHA512

90b9665b5b4aa260246c5f49a0a2a7ea850272d2c7d8c1a6cd2c6b545e41ce59ff280febd73ab1cbb59d2c4952d2de2a833f256dcb78e4994e4602a3ff88d9e9
SSDEEP

1536:KtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8We:K4v4JKXTx71w0ArSsXF3enq8We

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59ab640b53d772fec9e88db64c5dec00_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59ab640b53d772fec9e88db64c5dec00_NeikiAnalytics.dll,#1
  2⤵
  PID:2940