2fa4a838783d225c9dc2b1477741e136c58d62a4ebab4aaaebc2d6481a4e5017

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 00:10

Target

28c68024e34a24211fe8d1978c5fa3c0_NeikiAnalytics.dll
Size

81KB
MD5

28c68024e34a24211fe8d1978c5fa3c0
SHA1

3bb3ae940ae9aedc22930622928d360e533cd834
SHA256

2fa4a838783d225c9dc2b1477741e136c58d62a4ebab4aaaebc2d6481a4e5017
SHA512

ea6dadb630a6a4702355f19740ed750ee358bc225a355f63c4ff83d29dc7acb3c94e8aa9de87cd3e26f943def4b7e0eda4c99cd4d3722fa1f2fa977945cc3a2c
SSDEEP

1536:ytByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8W3:y4v4JKXTx71w0ArSsXF3enq8W3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2980	2344	rundll32.exe	28
PID 2344 wrote to memory of 2980	2344	rundll32.exe	28
PID 2344 wrote to memory of 2980	2344	rundll32.exe	28
PID 2344 wrote to memory of 2980	2344	rundll32.exe	28
PID 2344 wrote to memory of 2980	2344	rundll32.exe	28
PID 2344 wrote to memory of 2980	2344	rundll32.exe	28
PID 2344 wrote to memory of 2980	2344	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28c68024e34a24211fe8d1978c5fa3c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28c68024e34a24211fe8d1978c5fa3c0_NeikiAnalytics.dll,#1
  2⤵
  PID:2980