292d5f0183e3493567770e2566303cd315d20bae5ccb6668bc9d0c085b5f7766

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:38

Target

6f1273a62a6437cb46530bbee0964a20_NeikiAnalytics.dll
Size

81KB
MD5

6f1273a62a6437cb46530bbee0964a20
SHA1

1b67e7bfae1076c27aa4d11672b3fdf2a834637b
SHA256

292d5f0183e3493567770e2566303cd315d20bae5ccb6668bc9d0c085b5f7766
SHA512

20eb894e50ff8509f8c862763144e625f39fcc0f57fc038f2a94ea754664b92b7aecfab35d89f3a63aa1cf4affea2c105cf0b47f5ea5dbbd0c409d1db13f333a
SSDEEP

1536:6tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wl:64v4JKXTx71w0ArSsXF3enq8Wl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f1273a62a6437cb46530bbee0964a20_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f1273a62a6437cb46530bbee0964a20_NeikiAnalytics.dll,#1
2⤵
PID:1204