6cd947309785e2c928f9fcf1b23c3e4abe64fa6d0d561740bfea915583d0f99c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 10:39

Target

aa79704312943a79c62c6f0cd552b570_NeikiAnalytics.dll
Size

73KB
MD5

aa79704312943a79c62c6f0cd552b570
SHA1

213bb7fdeb954fa7ddd064cd37364960d4002c43
SHA256

6cd947309785e2c928f9fcf1b23c3e4abe64fa6d0d561740bfea915583d0f99c
SHA512

4a999b3ccb31f4bf598d49a3883a8e0a5539635054bbec56b0a6fdb99919e86a25db5ca86e62847dea6151352e22bd8c9ff3346a0a5266facc3e427b7dce3b43
SSDEEP

1536:hZZZZZZZZZZZZpyORgbwS7FGqmQx1Y7qcJK61hMqqU+2bbbAV2/S2uXKEi:vRGrLY7qct1hMqqDL2/uXK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	2908	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 2908 wrote to memory of 1972	2908	rundll32.exe	29
PID 2908 wrote to memory of 1972	2908	rundll32.exe	29
PID 2908 wrote to memory of 1972	2908	rundll32.exe	29
PID 2908 wrote to memory of 1972	2908	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa79704312943a79c62c6f0cd552b570_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa79704312943a79c62c6f0cd552b570_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 228
    3⤵
    - Program crash
    PID:1972