c2c15a0ad3662014584b96d7a5c35420ab4e315e58eba2af839693cf1c5523f0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 01:52

Target

777a2207c82e14cf2f7056bbb8091880_NeikiAnalytics.dll
Size

58KB
MD5

777a2207c82e14cf2f7056bbb8091880
SHA1

5be16ed6d118e8d2dfaa7ebd58703ea92841e780
SHA256

c2c15a0ad3662014584b96d7a5c35420ab4e315e58eba2af839693cf1c5523f0
SHA512

1bfe4f1076c63a3ee3e9c2ac8c9824755fa6a8a56c84072077ca7510f3a2b8bfacd29eae70c8ea30a4db44055ccb8ffb08e0369ef175492f6defdf99a5bc8275
SSDEEP

1536:g++mIpcQnCyfVIzFGMXRXe8Wvh9wnFwQVIi:gLmMv9YJhOtqnF7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28
PID 1376 wrote to memory of 2164	1376	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\777a2207c82e14cf2f7056bbb8091880_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\777a2207c82e14cf2f7056bbb8091880_NeikiAnalytics.dll,#1
  2⤵
  PID:2164