791450f2511c02363d1e2a3f2b5aa93a61cb033d4025d69789940cd270e1379c

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 19:48

Target

21aa04dfa2996fa731a8775e25f83100_NeikiAnalytics.dll
Size

81KB
MD5

21aa04dfa2996fa731a8775e25f83100
SHA1

2b8b197f3d658565307db55ba6ca174a9a8a9be6
SHA256

791450f2511c02363d1e2a3f2b5aa93a61cb033d4025d69789940cd270e1379c
SHA512

4c5da27315583b39d08966f44c0944768492347095344f4deb9ca4f833ce8f92ca79176aa206a3bd3133aedd6594e863271790e22909acb6ccfd56e1e68665d1
SSDEEP

1536:5tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wt:54v4JKXTx71w0ArSsXF3enq8Wt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3000	1784	rundll32.exe	28
PID 1784 wrote to memory of 3000	1784	rundll32.exe	28
PID 1784 wrote to memory of 3000	1784	rundll32.exe	28
PID 1784 wrote to memory of 3000	1784	rundll32.exe	28
PID 1784 wrote to memory of 3000	1784	rundll32.exe	28
PID 1784 wrote to memory of 3000	1784	rundll32.exe	28
PID 1784 wrote to memory of 3000	1784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21aa04dfa2996fa731a8775e25f83100_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21aa04dfa2996fa731a8775e25f83100_NeikiAnalytics.dll,#1
  2⤵
  PID:3000