00c3c6cf04b274aee94e363ed2aea7d42c960d1e18b8348be5bc848c29eac8e0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:09

Target

5ed279f50bece65fa769ab752febbee0_NeikiAnalytics.dll
Size

81KB
MD5

5ed279f50bece65fa769ab752febbee0
SHA1

259a6b060dff3bc58b677e803b9f5ae62a395ab9
SHA256

00c3c6cf04b274aee94e363ed2aea7d42c960d1e18b8348be5bc848c29eac8e0
SHA512

72fab4eb14bea9a11faba0287dce23b66aaada02dafb1a0c893b051d16cc730ee27ea2d91290ba09cc9ac41a4585d88f783c975df6ca01cf28b5e8d19fb5091a
SSDEEP

1536:+tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wi:+4v4JKXTx71w0ArSsXF3enq8Wi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2868 wrote to memory of 2916	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2916	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2916	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2916	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2916	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2916	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2916	2868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ed279f50bece65fa769ab752febbee0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ed279f50bece65fa769ab752febbee0_NeikiAnalytics.dll,#1
  2⤵
  PID:2916