8661c6b4509799ded640cfa6a523c13de5a9a547524b9b0efb0d12afb8391432

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 06:05

Target

ac6476e0961ea666814d955e254df3d0_NeikiAnalytics.dll
Size

81KB
MD5

ac6476e0961ea666814d955e254df3d0
SHA1

2e4f158e7247f063b8010bba5dc00ab96faf3969
SHA256

8661c6b4509799ded640cfa6a523c13de5a9a547524b9b0efb0d12afb8391432
SHA512

a8501f38ab3020c0ee654c2fbcab67e1365e84e1bfa6c1f2e2520d835d9adf44fde7c7a89f7fe7cd2d4abc75b87f7ad20a321fd916bf28c5eeacf744d030e458
SSDEEP

1536:atByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WZ:a4v4JKXTx71w0ArSsXF3enq8WZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2972	2312	rundll32.exe	28
PID 2312 wrote to memory of 2972	2312	rundll32.exe	28
PID 2312 wrote to memory of 2972	2312	rundll32.exe	28
PID 2312 wrote to memory of 2972	2312	rundll32.exe	28
PID 2312 wrote to memory of 2972	2312	rundll32.exe	28
PID 2312 wrote to memory of 2972	2312	rundll32.exe	28
PID 2312 wrote to memory of 2972	2312	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac6476e0961ea666814d955e254df3d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac6476e0961ea666814d955e254df3d0_NeikiAnalytics.dll,#1
  2⤵
  PID:2972