316d5ed77446652b3ef85e82f152910462943318cc385484c06d5db2ee574fc1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:48

Target

5b68284c30436b9e0ef5b9c9abbd9ed0_NeikiAnalytics.dll
Size

81KB
MD5

5b68284c30436b9e0ef5b9c9abbd9ed0
SHA1

d9e4741fa06d7c1173c2544cf4c053637b196d86
SHA256

316d5ed77446652b3ef85e82f152910462943318cc385484c06d5db2ee574fc1
SHA512

2059441588e737de82c0021db0673dedf9a5b3da805223aeebc3f37ebfa93fbb188169cc057b7c6554b4bec945c61cad2753a907fecb09854a02ecb807000eee
SSDEEP

1536:NtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WJ:N4v4JKXTx71w0ArSsXF3enq8WJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2952 wrote to memory of 2156	2952	rundll32.exe	rundll32.exe
PID 2952 wrote to memory of 2156	2952	rundll32.exe	rundll32.exe
PID 2952 wrote to memory of 2156	2952	rundll32.exe	rundll32.exe
PID 2952 wrote to memory of 2156	2952	rundll32.exe	rundll32.exe
PID 2952 wrote to memory of 2156	2952	rundll32.exe	rundll32.exe
PID 2952 wrote to memory of 2156	2952	rundll32.exe	rundll32.exe
PID 2952 wrote to memory of 2156	2952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b68284c30436b9e0ef5b9c9abbd9ed0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b68284c30436b9e0ef5b9c9abbd9ed0_NeikiAnalytics.dll,#1
2⤵
PID:2156