4d44809f9fc681305e6b3508ca4d854ead0c462eac799af3abf82e64390af2f5

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 06:39

Target

99449ee999d89aa92aedcbba1f919440_NeikiAnalytics.dll
Size

6KB
MD5

99449ee999d89aa92aedcbba1f919440
SHA1

8e0bbb989a915c204ac9916225dbaeafde75cdab
SHA256

4d44809f9fc681305e6b3508ca4d854ead0c462eac799af3abf82e64390af2f5
SHA512

7a28552d8d1cb12b3b70800d89f1795b2db914ae1d1dc0893598c3c1d534faa607d41d1af8514466e78d59a8b65befe0c50c6d50ada1619b9a4565b2109cc789
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0NB+BDq9J5SC:8qtV0HAr4EB+FqX5SC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99449ee999d89aa92aedcbba1f919440_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99449ee999d89aa92aedcbba1f919440_NeikiAnalytics.dll,#1
  2⤵
  PID:1924