46528dde75017e917c32464f2a22831de9c36f4574ebde5b2fd10d0098c0084b

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 18:50

Target

8cfa1beeb6051d6e696b9a37e478b330_NeikiAnalytics.dll
Size

574KB
MD5

8cfa1beeb6051d6e696b9a37e478b330
SHA1

5feadc87ffb9df32b4b5c78be2436cd8fbdfb360
SHA256

46528dde75017e917c32464f2a22831de9c36f4574ebde5b2fd10d0098c0084b
SHA512

a4ab6e43e919effb301a15a1903153f5c04a81d58a0fcf36478a77b87e0b0494a073a7ed7cf7693f9bb2a656cab39af4b558932b4279488b6f0f7c7528e95dda
SSDEEP

12288:HjMPUegSBcxfY1lE+Wgb3I7y8V4U3hp3aGBrghP5bD1zzAsTQAuAor2ZmOTyNDsT:HWX+aN7clDiOeF4boig7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2472	1952	rundll32.exe	28
PID 1952 wrote to memory of 2472	1952	rundll32.exe	28
PID 1952 wrote to memory of 2472	1952	rundll32.exe	28
PID 1952 wrote to memory of 2472	1952	rundll32.exe	28
PID 1952 wrote to memory of 2472	1952	rundll32.exe	28
PID 1952 wrote to memory of 2472	1952	rundll32.exe	28
PID 1952 wrote to memory of 2472	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cfa1beeb6051d6e696b9a37e478b330_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cfa1beeb6051d6e696b9a37e478b330_NeikiAnalytics.dll,#1
  2⤵
  PID:2472