921adc65c2fd3c2280beb994866851cd810eb6b8452e01b8279b057cef044607

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 18:22

Target

0c62fd5a8d4c274ad6e6a911282368e0_NeikiAnalytics.dll
Size

6.4MB
MD5

0c62fd5a8d4c274ad6e6a911282368e0
SHA1

f71513ca87b1ebab597acf4ac5a289747ebfa0f2
SHA256

921adc65c2fd3c2280beb994866851cd810eb6b8452e01b8279b057cef044607
SHA512

d09ad20c534e47a43f46919d88734aed487a42b7dbae41dadebdf83f4644fcc7835ac986be51917032c3d6b0c22125153fb0a47fbc64b54d568ad3746a3ec46b
SSDEEP

196608:mdD+1tJhIbliYS1CPwDvt3uFFZCBCKtv13uFnCPwMMMM:m41Ph0lVS1CPwDvt3uF7CBCKtv13uFn/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2908	2504	rundll32.exe	28
PID 2504 wrote to memory of 2908	2504	rundll32.exe	28
PID 2504 wrote to memory of 2908	2504	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c62fd5a8d4c274ad6e6a911282368e0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2504 -s 92
  2⤵
  PID:2908

memory/2504-0-0x000007FEF4F90000-0x000007FEF551F000-memory.dmp

Filesize
5.6MB

Download