0afb51d5e4c16b93d0bf2811ca4ef3718c2bd8b7cf83ef1bb2bcf23aaa12995d

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 17:52

Target

11d9cf7ec1ffb696b19ac4521b396ac0_NeikiAnalytics.dll
Size

81KB
MD5

11d9cf7ec1ffb696b19ac4521b396ac0
SHA1

2884a395bba2fb9ecf1085875a5352fa80342b86
SHA256

0afb51d5e4c16b93d0bf2811ca4ef3718c2bd8b7cf83ef1bb2bcf23aaa12995d
SHA512

1ae7bee438d98496d3069b0f5688f8ba60ae3685e7b7b297a672aa1a2da49abbebc74dec92cc3ce88ccf2ad9a3cb6e977e3f1f25ad6549e8ff80296a6bc4fbb5
SSDEEP

1536:BtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8W2:B4v4JKXTx71w0ArSsXF3enq8W2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11d9cf7ec1ffb696b19ac4521b396ac0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11d9cf7ec1ffb696b19ac4521b396ac0_NeikiAnalytics.dll,#1
  2⤵
  PID:2264