634e0ef1a0f9de6b25509f55e3af9327b562ea23810182fa242a1bffa6a98829

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 06:16

Target

5ef884ca1efca46e1c12311d676032e0_NeikiAnalytics.dll
Size

5KB
MD5

5ef884ca1efca46e1c12311d676032e0
SHA1

859affae9c94f33790df779302c923dd8e476414
SHA256

634e0ef1a0f9de6b25509f55e3af9327b562ea23810182fa242a1bffa6a98829
SHA512

8361b7c0ede3ea015b042a64b54e6a99051e346f0ed01a58547a1020e552b868a802e5fb471cdb1494d9e9506d46f8ca5fc069ed8f147130a735a240e13d4f85
SSDEEP

96:hy859x0P8MaE7dXILCfsvAaNfm8b9NB8DKDnOzJfo:F5oLLdYg30B8D8nOF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ef884ca1efca46e1c12311d676032e0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ef884ca1efca46e1c12311d676032e0_NeikiAnalytics.dll,#1
  2⤵
  PID:2996