bb3058b48818ce97f2322eb598462ceeab6964e01874f9d2ab74e98d137f27c2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 07:51

Target

a80535400c59b1cb4aa88ecca3135580_NeikiAnalytics.dll
Size

1.3MB
MD5

a80535400c59b1cb4aa88ecca3135580
SHA1

c752592354ec4015c7c0b5f6dee8dfbc6317581e
SHA256

bb3058b48818ce97f2322eb598462ceeab6964e01874f9d2ab74e98d137f27c2
SHA512

8539c079aba44e0010f4f4a5bda81774606be89ff3c6dab26a471255cba34b27e3ad8bcf5dc7772189479606d8b6d40e4d53dc041cd846cdcf19b776de22068f
SSDEEP

12288:qsWJXSOrittZABl3CXLflmZZAJTiwh40cr3udxUugdoQkt08kJgl1Sj3nVmFEH4H:A9l3CX7lAS4Rr3QxUubQktpkJ5rnVeJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2112	2384	rundll32.exe	28
PID 2384 wrote to memory of 2112	2384	rundll32.exe	28
PID 2384 wrote to memory of 2112	2384	rundll32.exe	28
PID 2384 wrote to memory of 2112	2384	rundll32.exe	28
PID 2384 wrote to memory of 2112	2384	rundll32.exe	28
PID 2384 wrote to memory of 2112	2384	rundll32.exe	28
PID 2384 wrote to memory of 2112	2384	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a80535400c59b1cb4aa88ecca3135580_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a80535400c59b1cb4aa88ecca3135580_NeikiAnalytics.dll,#1
  2⤵
  PID:2112