a87acadcdc320d65320b58fd4c66f8a3d84d6a9dea6bc17f100cb92d3bd84e27

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 21:14

Target

374ca620067a58e888e0fd6b5dc96ba0_NeikiAnalytics.dll
Size

81KB
MD5

374ca620067a58e888e0fd6b5dc96ba0
SHA1

056785cb6cdee6f77aee8fc7491c1f97fae71b11
SHA256

a87acadcdc320d65320b58fd4c66f8a3d84d6a9dea6bc17f100cb92d3bd84e27
SHA512

cbdc790412dc0de45f34603094c07ae38b9dd3e950b61c93b9317a05eddcd4fc5a31acbf1ae14e2d6493f911365c6de9ba2e7bfee8f83109824ed28f123dfe36
SSDEEP

1536:AtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wl:A4v4JKXTx71w0ArSsXF3enq8Wl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\374ca620067a58e888e0fd6b5dc96ba0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\374ca620067a58e888e0fd6b5dc96ba0_NeikiAnalytics.dll,#1
  2⤵
  PID:1648