afa5e6e0e51efd8a0cdefb8ef6f20416aa4cdc81093cc20760bd2f0be102ad2e

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 08:24

Target

9b406cae43a321679d4cdca3ca561490_NeikiAnalytics.dll
Size

7KB
MD5

9b406cae43a321679d4cdca3ca561490
SHA1

5b90a44ca641e4b331fe9c44701b3eb07abfe9d3
SHA256

afa5e6e0e51efd8a0cdefb8ef6f20416aa4cdc81093cc20760bd2f0be102ad2e
SHA512

27053871d1d663217631b2c9562532fd6d86566eb1a8934559195b90ed3d7ccf4ff76dc021d241d9d6fb1f7ba7b6e1c9d0c54351a3f45a042fe98ea9a9565b4c
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWCbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbP4q3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2044	2220	rundll32.exe	28
PID 2220 wrote to memory of 2044	2220	rundll32.exe	28
PID 2220 wrote to memory of 2044	2220	rundll32.exe	28
PID 2220 wrote to memory of 2044	2220	rundll32.exe	28
PID 2220 wrote to memory of 2044	2220	rundll32.exe	28
PID 2220 wrote to memory of 2044	2220	rundll32.exe	28
PID 2220 wrote to memory of 2044	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b406cae43a321679d4cdca3ca561490_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b406cae43a321679d4cdca3ca561490_NeikiAnalytics.dll,#1
  2⤵
  PID:2044