e1d9c9d0c1cdc589db94c440fe9ed4808d5065753682aba83c421eae23b1e760

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 02:38

Target

8cca1d978d9d2bef22eb29e11cba1a00_NeikiAnalytics.dll
Size

81KB
MD5

8cca1d978d9d2bef22eb29e11cba1a00
SHA1

524d3ee1b9b5350cfd0ad97c04bdbd3e79af8650
SHA256

e1d9c9d0c1cdc589db94c440fe9ed4808d5065753682aba83c421eae23b1e760
SHA512

1b2cb0b01a10631a75db86af7f9f90ec193f1b08ad815cb566ae3883be2f9661ea7fb23c21189772ffbd7facfd41d0dd2cacff758c1c66cb2967e0fbd530d1d8
SSDEEP

1536:ktByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8W0:k4v4JKXTx71w0ArSsXF3enq8W0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cca1d978d9d2bef22eb29e11cba1a00_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cca1d978d9d2bef22eb29e11cba1a00_NeikiAnalytics.dll,#1
  2⤵
  PID:2140