2f043486638377dae8b005fa5d258c6aa437e689af54f5ec5d00ce23fd50d270

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 07:06

Target

b894569c61e5c110ec2c018802780e20_NeikiAnalytics.dll
Size

38KB
MD5

b894569c61e5c110ec2c018802780e20
SHA1

9abc007d6a6120264a83687247997256ce932c81
SHA256

2f043486638377dae8b005fa5d258c6aa437e689af54f5ec5d00ce23fd50d270
SHA512

a68dfc4db8b77c680db2497d83ba09d8fc36af71bbac0b1494f00ed40d046d7a9c57d84349e0303258637bd579e6eea6341d4c634d754d80b5bc85dd26d219eb
SSDEEP

768:gR2Nr23COLK8wla/T4Jfl52HT6tHf+2PlvD0qX9eipPzbXttcYqvq:SYq3HLK8w24tfXx0qX9eitbXLqvq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2844	2956	rundll32.exe	28
PID 2956 wrote to memory of 2844	2956	rundll32.exe	28
PID 2956 wrote to memory of 2844	2956	rundll32.exe	28
PID 2956 wrote to memory of 2844	2956	rundll32.exe	28
PID 2956 wrote to memory of 2844	2956	rundll32.exe	28
PID 2956 wrote to memory of 2844	2956	rundll32.exe	28
PID 2956 wrote to memory of 2844	2956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b894569c61e5c110ec2c018802780e20_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b894569c61e5c110ec2c018802780e20_NeikiAnalytics.dll,#1
  2⤵
  PID:2844

memory/2844-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2844-2-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2844-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download