e0f77783ab7ef00feed310a30ab68b624635e39cb7633867efaac28d1f3f4d62

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 20:28

Target

2d147ef6ff01351efb5d31c012457760_NeikiAnalytics.dll
Size

392KB
MD5

2d147ef6ff01351efb5d31c012457760
SHA1

cebc20db7f995f86214cbe680bf3c774c496ab65
SHA256

e0f77783ab7ef00feed310a30ab68b624635e39cb7633867efaac28d1f3f4d62
SHA512

3bebcfc480ec2ad123b2804275b0dc33ccd2d282d2ccfb9093922f96bd0bda40e2965bc73bde5db61f24a79a6b9f7bc2e39eecc465e4a1097d3a448b6e8edf20
SSDEEP

6144:cRCoktCaCZxl+STZLG2LQjeQWEAUbW5gk78aHZzvLSA+yvYvZq:hhZSTUjRbu78aHZ6UMZq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d147ef6ff01351efb5d31c012457760_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d147ef6ff01351efb5d31c012457760_NeikiAnalytics.dll,#1
  2⤵
  PID:2996

memory/2996-0-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/2996-1-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download