ff319c7d58aba942de7f40de30d4955b3f14878887b70b998a0bd4defde22486

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 03:35

Target

72124a1b40aa028b4c5e63c73f1ddae0_NeikiAnalytics.dll
Size

81KB
MD5

72124a1b40aa028b4c5e63c73f1ddae0
SHA1

b7f05d3d7b8e3566c491a075a6d8e00627ea9fab
SHA256

ff319c7d58aba942de7f40de30d4955b3f14878887b70b998a0bd4defde22486
SHA512

6c763339bb1cee98604a33361e60d27ff142938ce2aea31d6b26d8932b2944f9540fb602284d810672666be4d1ce69017218dab34568a48f9cfc68422e1f19fd
SSDEEP

1536:4c+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GA:X+5oxmqAiR8+/RBkez0U+P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 1772	2784	rundll32.exe	28
PID 2784 wrote to memory of 1772	2784	rundll32.exe	28
PID 2784 wrote to memory of 1772	2784	rundll32.exe	28
PID 2784 wrote to memory of 1772	2784	rundll32.exe	28
PID 2784 wrote to memory of 1772	2784	rundll32.exe	28
PID 2784 wrote to memory of 1772	2784	rundll32.exe	28
PID 2784 wrote to memory of 1772	2784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72124a1b40aa028b4c5e63c73f1ddae0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72124a1b40aa028b4c5e63c73f1ddae0_NeikiAnalytics.dll,#1
  2⤵
  PID:1772