9ef157c474ca2bb15084d6ca857c39417d1164cae8563398fcc483ff5a5dfa70

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 07:11

Target

a02961d5ea6b83cf775d33b1334f0980_NeikiAnalytics.dll
Size

81KB
MD5

a02961d5ea6b83cf775d33b1334f0980
SHA1

835a3cbdf66b807f5daa2c41dc3c5448d518763b
SHA256

9ef157c474ca2bb15084d6ca857c39417d1164cae8563398fcc483ff5a5dfa70
SHA512

f9b15e03789d861232a6193c0b53372ef8099ac42263bf71e969dbd6a919da552b3f27f7f6968d68c687b2371d20ef8778378a193737f9193254767f51edc1ef
SSDEEP

1536:3tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wp:34v4JKXTx71w0ArSsXF3enq8Wp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a02961d5ea6b83cf775d33b1334f0980_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a02961d5ea6b83cf775d33b1334f0980_NeikiAnalytics.dll,#1
  2⤵
  PID:2496