30ce5196419c5d7dc149ce9e149e95f43b39d5db1907dbc7c3d3952f8d0f5849

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:57

Target

150dc4587f275087f66586335b3f1770_NeikiAnalytics.dll
Size

5KB
MD5

150dc4587f275087f66586335b3f1770
SHA1

1d91c64ae0e55d464187deadbb8a6285f2aa6b47
SHA256

30ce5196419c5d7dc149ce9e149e95f43b39d5db1907dbc7c3d3952f8d0f5849
SHA512

7ad07c03233477f446389d035b85110d7aa5db06427eacdce69a64dd0ec0073855cb23533d0b6df37b4515e211086839d5938ebdb2273610fea21f67c837f199
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqCsUll6rE4t18mU5ei564GRwctJH9Y21RVP:hy859x0P8Ma8nWE4Me34etN9jVZgr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2012 wrote to memory of 1752	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1752	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1752	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1752	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1752	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1752	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1752	2012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\150dc4587f275087f66586335b3f1770_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\150dc4587f275087f66586335b3f1770_NeikiAnalytics.dll,#1
2⤵
PID:1752