480d2f5adeeb5207a15d51c728188762b3d18d3e96e9edb490fa6c32d30aa675

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 05:52

Target

3d70bf9827b6f54867a54bad14abe6f0_NeikiAnalytics.dll
Size

211KB
MD5

3d70bf9827b6f54867a54bad14abe6f0
SHA1

b33780dfda07575ae84ff337993afa0a922e044d
SHA256

480d2f5adeeb5207a15d51c728188762b3d18d3e96e9edb490fa6c32d30aa675
SHA512

7f062d3fa3f0cc35a122ecd515a796e3a605ff6023d63855571e58488d948991599d4eb44b9f92572f3d96148507395a468e183b8323e82e39d5baee2de3d7a9
SSDEEP

6144:fMAzTAcVzigig4kvo1hfpzGygBcVz3ulG:fMA3AcVue4j3uA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d70bf9827b6f54867a54bad14abe6f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d70bf9827b6f54867a54bad14abe6f0_NeikiAnalytics.dll,#1
  2⤵
  PID:2892