21c437b29cd111e6adc6a26bff91f1aa5e4e9fb534dc9a9839d9c977475dc6de

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 18:59

Target

19f0e1a1da2b92cf30dacfbd9ff34da0_NeikiAnalytics.dll
Size

6KB
MD5

19f0e1a1da2b92cf30dacfbd9ff34da0
SHA1

c3af43199b6dd42c122f78aabd0f5774c47f9170
SHA256

21c437b29cd111e6adc6a26bff91f1aa5e4e9fb534dc9a9839d9c977475dc6de
SHA512

0f694345d871d5fc2e95ad34d76d93081e17bc6d36780023edd2894289da9ca5d08ae9c7f2b37421b112e363949a1b92dc9dc3c0e79b209804befe2933ad8670
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU10ylB+BDq9J5SV3DY:CSVVEPozmB74B+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19f0e1a1da2b92cf30dacfbd9ff34da0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19f0e1a1da2b92cf30dacfbd9ff34da0_NeikiAnalytics.dll,#1
  2⤵
  PID:2468