b92de5c3aed26ece2af70d239e05b359b29340c20d3b41b4ad726d263c25f075

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 02:06

Target

848c7ab33e7540bfa253bb0e67df3740_NeikiAnalytics.dll
Size

26KB
MD5

848c7ab33e7540bfa253bb0e67df3740
SHA1

32e24131808ceebb90b73236d7d9f77248b8d429
SHA256

b92de5c3aed26ece2af70d239e05b359b29340c20d3b41b4ad726d263c25f075
SHA512

43f528d8ad5eec8404e84e0cf6ec6b984d4f26fff3002267bd17f7f9178beb0e592adcfaf6e9abe4166147e33e96b73a9c6640ac0d54ca699e33ccd360ce3b6b
SSDEEP

384:i5PdCjeWEPc4IR8FFqzdUDPoDeoBahl0F6Bph:oPc4IR8FAzd9H6B

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2248	868	rundll32.exe	28
PID 868 wrote to memory of 2248	868	rundll32.exe	28
PID 868 wrote to memory of 2248	868	rundll32.exe	28
PID 868 wrote to memory of 2248	868	rundll32.exe	28
PID 868 wrote to memory of 2248	868	rundll32.exe	28
PID 868 wrote to memory of 2248	868	rundll32.exe	28
PID 868 wrote to memory of 2248	868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\848c7ab33e7540bfa253bb0e67df3740_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\848c7ab33e7540bfa253bb0e67df3740_NeikiAnalytics.dll,#1
  2⤵
  PID:2248