54a58c61daa3028007d9b3df3ae244e3e20497062699eb70459e59c5866a3712

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 03:03

Target

92d0a7e3120d2e46bf6ba5c0e9733c20_NeikiAnalytics.dll
Size

5KB
MD5

92d0a7e3120d2e46bf6ba5c0e9733c20
SHA1

d449aac138119af07ab50b7136dad2e911838cb1
SHA256

54a58c61daa3028007d9b3df3ae244e3e20497062699eb70459e59c5866a3712
SHA512

91cf0d4821a39b6929a99d37c582edd80df85f84c22f423bdbbd4e8526356377d5f68a40a4657a21ee807041e6b70e3c1952b2d8b28df08eabf3cd2a3abf3f1c
SSDEEP

24:e31GSByDXy8e53+m//pQVSRvtj49kv/imRg5hHafep9afepENvhafepGi/lmxMxQ:CCy86+Wet9Q/iooHeiefhe+/lSMYEq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1464	2020	rundll32.exe	28
PID 2020 wrote to memory of 1464	2020	rundll32.exe	28
PID 2020 wrote to memory of 1464	2020	rundll32.exe	28
PID 2020 wrote to memory of 1464	2020	rundll32.exe	28
PID 2020 wrote to memory of 1464	2020	rundll32.exe	28
PID 2020 wrote to memory of 1464	2020	rundll32.exe	28
PID 2020 wrote to memory of 1464	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d0a7e3120d2e46bf6ba5c0e9733c20_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d0a7e3120d2e46bf6ba5c0e9733c20_NeikiAnalytics.dll,#1
  2⤵
  PID:1464