165c9d307a10b39276a842bd49e8d104b30bd5decf92a7c93d19efbaa3cc8705

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 22:02

Target

472630f89e58e926f0d3c9245ec27860_NeikiAnalytics.dll
Size

72KB
MD5

472630f89e58e926f0d3c9245ec27860
SHA1

4a0b742bbdae508e2ae5dd818841b8d77a490641
SHA256

165c9d307a10b39276a842bd49e8d104b30bd5decf92a7c93d19efbaa3cc8705
SHA512

684b45fefb002c02050e1b39661eb801b863e1decfb550bdfb656f0ed1490a0801333c65b1615c82831f9b5b4361b98a3fb173867122a75e4b85cfbe5689e9f6
SSDEEP

1536:YgZL9S5PzVfP5VHAnToIfjIOlIOuiLYhA:YgZLAB5V0TBfFvuiLYhA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	1448	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1448	2292	rundll32.exe	28
PID 2292 wrote to memory of 1448	2292	rundll32.exe	28
PID 2292 wrote to memory of 1448	2292	rundll32.exe	28
PID 2292 wrote to memory of 1448	2292	rundll32.exe	28
PID 2292 wrote to memory of 1448	2292	rundll32.exe	28
PID 2292 wrote to memory of 1448	2292	rundll32.exe	28
PID 2292 wrote to memory of 1448	2292	rundll32.exe	28
PID 1448 wrote to memory of 2056	1448	rundll32.exe	29
PID 1448 wrote to memory of 2056	1448	rundll32.exe	29
PID 1448 wrote to memory of 2056	1448	rundll32.exe	29
PID 1448 wrote to memory of 2056	1448	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\472630f89e58e926f0d3c9245ec27860_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\472630f89e58e926f0d3c9245ec27860_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 228
    3⤵
    - Program crash
    PID:2056