a5b394f81b8774857eb4265f3e6db499dfafae4eb8ad19cb48fab412da448d89

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 05:02

Target

8419398e8e05f7f1a85918d522b24030_NeikiAnalytics.dll
Size

72KB
MD5

8419398e8e05f7f1a85918d522b24030
SHA1

425f69f91865f6d563ab641f1db0db7183566f52
SHA256

a5b394f81b8774857eb4265f3e6db499dfafae4eb8ad19cb48fab412da448d89
SHA512

69c997a7be15e6d0972be8b64067a4951d7e4a4239489fd6b3fea3b4ee511bdff5e9d0fd30e2892e683a994dfefb91c0f61ca29502dacdbe27b325a9f94190aa
SSDEEP

384:zqgsxvB5PULK1PlOEo1/TCXrGVsSc9PVjamll1qoSauyAQHo7/+c8Jo96VsK4P:zpsxHjI/TMKkFVjefiHo76Jo9k9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	2072	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2072 wrote to memory of 1736	2072	rundll32.exe	29
PID 2072 wrote to memory of 1736	2072	rundll32.exe	29
PID 2072 wrote to memory of 1736	2072	rundll32.exe	29
PID 2072 wrote to memory of 1736	2072	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8419398e8e05f7f1a85918d522b24030_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8419398e8e05f7f1a85918d522b24030_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 228
    3⤵
    - Program crash
    PID:1736