75c2ee9f7642b5eb0449a7963540ae42e5f474dc324c7a5ebc42dc1db6caf5bd

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 20:02

Target

24cc91f53e7575f0f13a02514be42d00_NeikiAnalytics.dll
Size

81KB
MD5

24cc91f53e7575f0f13a02514be42d00
SHA1

5c4da54c0f0f4fd9756f7a373a7e3e3edc4badc0
SHA256

75c2ee9f7642b5eb0449a7963540ae42e5f474dc324c7a5ebc42dc1db6caf5bd
SHA512

1792f0dbe83c4b2383d31a1ba782a5d6a437d4ffd135d19d4781e6a96067ba3dc92c9d62063271e9b0933031bd7ce3bacc221555ca7089aced6834670a63fcb2
SSDEEP

1536:7tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WZ:74v4JKXTx71w0ArSsXF3enq8WZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24cc91f53e7575f0f13a02514be42d00_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24cc91f53e7575f0f13a02514be42d00_NeikiAnalytics.dll,#1
  2⤵
  PID:2008