88c691f5b0c986349f6cda8f16bd7fc5f6f5f0dcda5cbf94ac10e644dc27a54d

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 21:25

Target

87e166344581e6ad97f1a742efe659d0_NeikiAnalytics.dll
Size

771KB
MD5

87e166344581e6ad97f1a742efe659d0
SHA1

40c40e497c2e75c39cb5cc3ca7b19d609c8ae645
SHA256

88c691f5b0c986349f6cda8f16bd7fc5f6f5f0dcda5cbf94ac10e644dc27a54d
SHA512

dca5a36e1f3c0e177afbcbc8680ccc5fc00d1c07dfa295291914f216b95edde65b7432bad3bd63109ad4336841491bc604615cacaff6bdb5b3ff1b9067b19350
SSDEEP

24576:HCTNJrbfRbCdKLIGd+3W8RSOouHuv3IXDt:2nrtbCd+ddGEOov3YZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1308 wrote to memory of 1748	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1748	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1748	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1748	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1748	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1748	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1748	1308	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\87e166344581e6ad97f1a742efe659d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\87e166344581e6ad97f1a742efe659d0_NeikiAnalytics.dll,#1
2⤵
PID:1748

memory/1748-0-0x0000000000230000-0x000000000026D000-memory.dmp

Filesize
244KB

Download