5960836d3324005981fcce8fdd45f92a558caae3c9e22409d8fec2173f61bcad

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 23:24

Target

34ce748206ee9757796aca0cf096d330_NeikiAnalytics.dll
Size

81KB
MD5

34ce748206ee9757796aca0cf096d330
SHA1

271b6c0fb231d516af6fd73e7f1ffc51ac13c4c6
SHA256

5960836d3324005981fcce8fdd45f92a558caae3c9e22409d8fec2173f61bcad
SHA512

8c3c49fee7260ce43a02fb55429b168df11298f4ba9b4c1b614920526907b0a00c0bee7d8aba4647c2cd00488e95170d60fe1abbe2243c652e2f8a94db4fa516
SSDEEP

1536:7tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WC:74v4JKXTx71w0ArSsXF3enq8WC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28
PID 2984 wrote to memory of 2996	2984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34ce748206ee9757796aca0cf096d330_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34ce748206ee9757796aca0cf096d330_NeikiAnalytics.dll,#1
  2⤵
  PID:2996