d6755c8ef192560842bbb373f6f565a6e0acf9b5914561fd114aec1af57d418c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 17:15

Target

78f29191afc222e8d80a3cf8b9b48dc0_NeikiAnalytics.dll
Size

98KB
MD5

78f29191afc222e8d80a3cf8b9b48dc0
SHA1

4cdf513c7af5f5db9cdaa3a09890a769ef07f840
SHA256

d6755c8ef192560842bbb373f6f565a6e0acf9b5914561fd114aec1af57d418c
SHA512

a9971e7a3c402a894997b9aeafcca605df09af09e273a20d46e0e65c374aa2dc0fdc43304a6253a9accfa790fbac42ccf76d3efb06e9db48886c78b58888667f
SSDEEP

3072:MeDe6R7TmdDAOZduNyuVIdUJvym21y18rFFN:MweiO5A0Ygui2Jvb2yEN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3000	2440	rundll32.exe	28
PID 2440 wrote to memory of 3000	2440	rundll32.exe	28
PID 2440 wrote to memory of 3000	2440	rundll32.exe	28
PID 2440 wrote to memory of 3000	2440	rundll32.exe	28
PID 2440 wrote to memory of 3000	2440	rundll32.exe	28
PID 2440 wrote to memory of 3000	2440	rundll32.exe	28
PID 2440 wrote to memory of 3000	2440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78f29191afc222e8d80a3cf8b9b48dc0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78f29191afc222e8d80a3cf8b9b48dc0_NeikiAnalytics.dll,#1
  2⤵
  PID:3000