51bb59628769ddcde2e7ecb3a4f12efefae678ecfbdac75651857704447a62d6

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 13:07

Target

51bb59628769ddcde2e7ecb3a4f12efefae678ecfbdac75651857704447a62d6_NeikiAnalytics.dll
Size

7KB
MD5

f74544c0cb722af2c523e42fc48973c0
SHA1

d9e57a62af2930a6a007768c3f3d07a16135ad34
SHA256

51bb59628769ddcde2e7ecb3a4f12efefae678ecfbdac75651857704447a62d6
SHA512

a943b337a277a32d960800143a1f9850947248ea1962f5e3799d185b9c33fd4c27d4eab9aa87e572ff27fa5ce808673140b2a355829bc2c2708d828f061b21e3
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaP1d3cX5aXW:wUaJf/aFbP0OS2JaX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1624	2976	rundll32.exe	28
PID 2976 wrote to memory of 1624	2976	rundll32.exe	28
PID 2976 wrote to memory of 1624	2976	rundll32.exe	28
PID 2976 wrote to memory of 1624	2976	rundll32.exe	28
PID 2976 wrote to memory of 1624	2976	rundll32.exe	28
PID 2976 wrote to memory of 1624	2976	rundll32.exe	28
PID 2976 wrote to memory of 1624	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51bb59628769ddcde2e7ecb3a4f12efefae678ecfbdac75651857704447a62d6_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51bb59628769ddcde2e7ecb3a4f12efefae678ecfbdac75651857704447a62d6_NeikiAnalytics.dll,#1
  2⤵
  PID:1624