f3ae67df4ce0e39412d360b3475bf31d81f60050f56e6ed10c5628b89f66e498

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 23:35

Target

ffccc40b6bc82c7c654c1c92bf5c9e80_NeikiAnalytics.dll
Size

327KB
MD5

ffccc40b6bc82c7c654c1c92bf5c9e80
SHA1

6535b18992f027d53ee854a30986350c874f8514
SHA256

f3ae67df4ce0e39412d360b3475bf31d81f60050f56e6ed10c5628b89f66e498
SHA512

4be891e124859e9a0e7a89d4c0eec7a0e354fa668f17763dd8e8f62802461a2ac3f919770067f600567b35b2e0d59cc3c88fd79bc5a198bf54cd6036aeae4c55
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffccc40b6bc82c7c654c1c92bf5c9e80_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffccc40b6bc82c7c654c1c92bf5c9e80_NeikiAnalytics.dll,#1
  2⤵
  PID:3044