27cc44cf671dcd1272be2432ca8eb18763d11ef8bc72831e2fde0b942c3c5c0e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 14:59

Target

d78f6693aeec02066ffbc5590fc19640_NeikiAnalytics.dll
Size

7KB
MD5

d78f6693aeec02066ffbc5590fc19640
SHA1

be86b7d7a16b97f1cc3fa038ac839cf230a0c377
SHA256

27cc44cf671dcd1272be2432ca8eb18763d11ef8bc72831e2fde0b942c3c5c0e
SHA512

2d333102d4bba432262985435126d19c236c73d662a2235a3c3f8f42882ed90fffb9966452051bff089a1194b67ee0ae4393e237ef3394a2084094bdb73b0d3d
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW3cbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPGzq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d78f6693aeec02066ffbc5590fc19640_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d78f6693aeec02066ffbc5590fc19640_NeikiAnalytics.dll,#1
  2⤵
  PID:2356