1f6ee07959268978d0888e33a1e83dc78a2d81ce6c7b6788062c34a42dce531a

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:41

Target

b3b970de8c8393a843c4919eb2b044b0_NeikiAnalytics.dll
Size

6KB
MD5

b3b970de8c8393a843c4919eb2b044b0
SHA1

0779260ccf886aa3da8a5d515adee2edf1a24ed5
SHA256

1f6ee07959268978d0888e33a1e83dc78a2d81ce6c7b6788062c34a42dce531a
SHA512

90b59f72f2a395e607f0358bc8b073184949e4f14d3f0677a564c3a9fe651b6ca33dbe4ef5cbd0cbdc1597717030739478490a839aa18a56ad0e2f9dc490baa0
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIGnu78QHLJTl9YrTNcYGEJ5jR:unSR6bgYlWrBwyE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3b970de8c8393a843c4919eb2b044b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3b970de8c8393a843c4919eb2b044b0_NeikiAnalytics.dll,#1
  2⤵
  PID:2772