0b433b75525d175afe2d001402b4c4f84adfad228f44cf8851cd9062ddb5fe5c

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 05:57

Target

aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll
Size

6KB
MD5

aab046d8dab5bcbbcfd6821b45a27ea0
SHA1

9262970247eb4aaec6053f1bdb642670e9c412ba
SHA256

0b433b75525d175afe2d001402b4c4f84adfad228f44cf8851cd9062ddb5fe5c
SHA512

3d32aa76ebf5c838e7fcac60c2296375b4da07f4edf08814a34ba35aa25fb903dd63a4c379dd3fa3895c6a6a49ca137e97b48b1798858727b8b998383fd6aba9
SSDEEP

96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7bSLVI:juLJ/oAdQPQa2aeng7bSi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2212	1692	rundll32.exe	28
PID 1692 wrote to memory of 2212	1692	rundll32.exe	28
PID 1692 wrote to memory of 2212	1692	rundll32.exe	28
PID 1692 wrote to memory of 2212	1692	rundll32.exe	28
PID 1692 wrote to memory of 2212	1692	rundll32.exe	28
PID 1692 wrote to memory of 2212	1692	rundll32.exe	28
PID 1692 wrote to memory of 2212	1692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aab046d8dab5bcbbcfd6821b45a27ea0_NeikiAnalytics.dll,#1
  2⤵
  PID:2212