ab2fbdb271b7fa52c735a4325bfb0fea00c2526a58a08811edfa29bfe1bd8eac

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 05:59

Target

90f8becb9cfd1b96b9a0043899bce000_NeikiAnalytics.dll
Size

5KB
MD5

90f8becb9cfd1b96b9a0043899bce000
SHA1

fcfe0ad7d5f1459f9d500b6f38f0db458f3cb943
SHA256

ab2fbdb271b7fa52c735a4325bfb0fea00c2526a58a08811edfa29bfe1bd8eac
SHA512

2fb4f9514a33f5a188d08ba4c474dd4456caa76a84ab7831aa9d6947c66f6dac3a0e24120899f62f3966e920a82c613f1080b2788c20d6d51cd94e0ac0468b10
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqkn/MHkq0ooV2WR/g226ZP9YBNDLu:hy859x0P8Mak/MHO5R/sCPw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2132	2056	rundll32.exe	28
PID 2056 wrote to memory of 2132	2056	rundll32.exe	28
PID 2056 wrote to memory of 2132	2056	rundll32.exe	28
PID 2056 wrote to memory of 2132	2056	rundll32.exe	28
PID 2056 wrote to memory of 2132	2056	rundll32.exe	28
PID 2056 wrote to memory of 2132	2056	rundll32.exe	28
PID 2056 wrote to memory of 2132	2056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90f8becb9cfd1b96b9a0043899bce000_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90f8becb9cfd1b96b9a0043899bce000_NeikiAnalytics.dll,#1
  2⤵
  PID:2132