665e9bee274e09d8f3993fdd7b1eb022450223d2b0897fbe161199df7c5b4303

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 05:12

Target

b10a1b883fc7779d401d2d7ae60290b0_NeikiAnalytics.dll
Size

81KB
MD5

b10a1b883fc7779d401d2d7ae60290b0
SHA1

7c57d4c7cf2e99e668f245354585826c8f5538f6
SHA256

665e9bee274e09d8f3993fdd7b1eb022450223d2b0897fbe161199df7c5b4303
SHA512

f11e56dc73e6ed30d2ef7cdc4d6aa7728644d3f64b78d97802aa8169f105a5685ea50db784f2102d76c3315d4151b7a94a3b7c94c0b2246a722455b30d4739d2
SSDEEP

1536:AtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wf:A4v4JKXTx71w0ArSsXF3enq8Wf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b10a1b883fc7779d401d2d7ae60290b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b10a1b883fc7779d401d2d7ae60290b0_NeikiAnalytics.dll,#1
  2⤵
  PID:2992