e0fccb3466de7f984cac67ee68e97dd8342314f9cf0683fffba02c82d046bf5b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 23:41

Target

6211a2872d6fabbd57d712cd0eb791f0_NeikiAnalytics.dll
Size

327KB
MD5

6211a2872d6fabbd57d712cd0eb791f0
SHA1

621f50bc9c754552ce00f4f2623c6ab774b75088
SHA256

e0fccb3466de7f984cac67ee68e97dd8342314f9cf0683fffba02c82d046bf5b
SHA512

be58af951e967f9fc6196b85b096616f1667dfa03708cd5fab248279fdc1564604738c84171f37730f162d5699637cee55df17d68c697d8b9235cfd41691f962
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 2940	332	rundll32.exe	28
PID 332 wrote to memory of 2940	332	rundll32.exe	28
PID 332 wrote to memory of 2940	332	rundll32.exe	28
PID 332 wrote to memory of 2940	332	rundll32.exe	28
PID 332 wrote to memory of 2940	332	rundll32.exe	28
PID 332 wrote to memory of 2940	332	rundll32.exe	28
PID 332 wrote to memory of 2940	332	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6211a2872d6fabbd57d712cd0eb791f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6211a2872d6fabbd57d712cd0eb791f0_NeikiAnalytics.dll,#1
  2⤵
  PID:2940