cf2c81d66b27812e63446cbe15a09d1485ce76e24695dd6b34b8e0bd692bc1f5

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:09

Target

54201b70526429b3391fded99dd5b360_NeikiAnalytics.dll
Size

824KB
MD5

54201b70526429b3391fded99dd5b360
SHA1

114ff0570dca71e92fab41cf606d43de5d7ee515
SHA256

cf2c81d66b27812e63446cbe15a09d1485ce76e24695dd6b34b8e0bd692bc1f5
SHA512

53b25c22525493f5655ca4b563feea4222f4cd2c54c78f638d92414031d3a3a1c6d47ce7a315db71e9523150cb0f15dcd02e483a88a969f915e0714e878ff8d7
SSDEEP

24576:D7WzW5v1kM8BpDLQqIK15sEwzCHwcIVa5w2/5eE:fWA118nPIKozcf/IE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3040 wrote to memory of 2892	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2892	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2892	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2892	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2892	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2892	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2892	3040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54201b70526429b3391fded99dd5b360_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54201b70526429b3391fded99dd5b360_NeikiAnalytics.dll,#1
2⤵
PID:2892