fbdd6c1cda7381dd67458895bd90ee7c95dfd1a90ea1907fdec7602d8f317a04

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 10:29

Target

78634ffd50c903ca3c6976acadc05990_NeikiAnalytics.dll
Size

329KB
MD5

78634ffd50c903ca3c6976acadc05990
SHA1

66e97f049c26b0fabda6c2afed84cc5530c87063
SHA256

fbdd6c1cda7381dd67458895bd90ee7c95dfd1a90ea1907fdec7602d8f317a04
SHA512

3138d9d407d5861062cf34183cd49d42b4d4090eaebe38050669193e5a7d7ac350f7990a14904106062f9a030f71c82dc324369acd1772d4545a47f69c0bba6e
SSDEEP

6144:RmWhxR1arY/PbgmFOabPIIBhJXAv7eTY9suz0xhttGSrDKE3KIvSka8b/:RmWTR1arYnEKosuzY34CZ3DvSkN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78634ffd50c903ca3c6976acadc05990_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78634ffd50c903ca3c6976acadc05990_NeikiAnalytics.dll,#1
  2⤵
  PID:2584