426da98d5ead2a04cc551eb856ad9bb831880d6120a9c98acb25892c1b8bf9e6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 11:43

Target

426da98d5ead2a04cc551eb856ad9bb831880d6120a9c98acb25892c1b8bf9e6_NeikiAnalytics.dll
Size

100KB
MD5

566adaa4349e23637eaa2cbdfe33da20
SHA1

9ed3522590a44a5309d0da9c6577db987734c0ab
SHA256

426da98d5ead2a04cc551eb856ad9bb831880d6120a9c98acb25892c1b8bf9e6
SHA512

c8796d1495317101cf75d33919d615b4332705bac8ad9816e452266978215095e9d2607d9a79fdf8260b26c3c6aa8525e4bd11363cc67b8883bab3a1c5eae556
SSDEEP

1536:c76RzHd3x4Tzm46LT2X33gNXkdqdB/Xar0N6k00IxEoFSVzx:3blx42s38kav96/0IxEoF8V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\426da98d5ead2a04cc551eb856ad9bb831880d6120a9c98acb25892c1b8bf9e6_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\426da98d5ead2a04cc551eb856ad9bb831880d6120a9c98acb25892c1b8bf9e6_NeikiAnalytics.dll,#1
  2⤵
  PID:2320