ee7a8dfc4d5a1c4ee05f7d18e4a9d52cdd2dddd33568ae3c58d13930706a7d29

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:06

Target

53ba7132c744f7f6b079d629ddc8e660_NeikiAnalytics.dll
Size

54KB
MD5

53ba7132c744f7f6b079d629ddc8e660
SHA1

05653936bddceb6ccb957e46e09c16716487e36d
SHA256

ee7a8dfc4d5a1c4ee05f7d18e4a9d52cdd2dddd33568ae3c58d13930706a7d29
SHA512

1f1b6d7a723e481117e8a3787474c12331aecc2265fd346903772236d9667507cd9ad116378cb968a2037cbec81006278d78f1bcaa2bb38a0b557a3d61e7d474
SSDEEP

1536:Z7g37hujj6+V1byTxTksEooN8b+YfzMQ7q:Z7g37hujm+V1buksEoliYfz0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1852 wrote to memory of 1608	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1608	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1608	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1608	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1608	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1608	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1608	1852	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53ba7132c744f7f6b079d629ddc8e660_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53ba7132c744f7f6b079d629ddc8e660_NeikiAnalytics.dll,#1
2⤵
PID:1608

memory/1608-0-0x0000000061000000-0x0000000061023000-memory.dmp

Filesize
140KB

Download
memory/1608-1-0x0000000061000000-0x0000000061023000-memory.dmp

Filesize
140KB

Download