c15965c6d70ec1971d048a36f1c76ec4a905a7f046aff00a4b4d9ae29a431dbb

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 02:34

Target

8bc819ba033a36abe9909cc41c9b3df0_NeikiAnalytics.dll
Size

18KB
MD5

8bc819ba033a36abe9909cc41c9b3df0
SHA1

7dc73627e6d2c4262268df5015f9759a04d867f9
SHA256

c15965c6d70ec1971d048a36f1c76ec4a905a7f046aff00a4b4d9ae29a431dbb
SHA512

f450b78af3febc1229ee29818a1a650c7894590efe1aff8592f9bcaa22fd536a7f60a742b9cea6d8022eba36bf8111b24a1d1c73692c7b57b85801832855d561
SSDEEP

192:FcUrtTzm1F4wCEFBpFEd0R6aqFLxlpKCiPbN/mC6Nu+Spc5E2:eUrZzm1FqEFedtaGL8Cix/H60+S+E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2252	2920	rundll32.exe	28
PID 2920 wrote to memory of 2252	2920	rundll32.exe	28
PID 2920 wrote to memory of 2252	2920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8bc819ba033a36abe9909cc41c9b3df0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2920 -s 128
  2⤵
  PID:2252