d260a5ef50dc0f91451530dafac39dc892f2e84a2243ec54249bba6302c27982

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:35

Target

358bad4f1f34350989075de6f77a6ec0_NeikiAnalytics.dll
Size

534KB
MD5

358bad4f1f34350989075de6f77a6ec0
SHA1

ae8026204ef6f1107192c55bc3b811a40a504181
SHA256

d260a5ef50dc0f91451530dafac39dc892f2e84a2243ec54249bba6302c27982
SHA512

b1d87fb5a6259872e9bd8751629de8f9c272ec82a598291dfc9f69a46115620029a95b0ce9e9d13fd0e72cb0bd6a3f5e08fce4156c03b5f42ba8f54457f184ba
SSDEEP

6144:hOC6U25wfuTUlhk/P6CB2qKrzG0+L0jgPjozPJQzIUm4o3Z+0dX6XO3+gN1/3iVB:h8wetmAtiyXtSjX8SBrQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2200 wrote to memory of 1612	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 1612	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 1612	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 1612	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 1612	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 1612	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 1612	2200	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\358bad4f1f34350989075de6f77a6ec0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\358bad4f1f34350989075de6f77a6ec0_NeikiAnalytics.dll,#1
2⤵
PID:1612