4053fac7d1f27b13cd7556fa512a90773b38819a2b5fee9afe26ae7628a8e155

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 12:56

Target

615275bc0025bea13692fb0648ee1f30_NeikiAnalytics.dll
Size

81KB
MD5

615275bc0025bea13692fb0648ee1f30
SHA1

f86b512ba52d5f6255b3eb1ccf0de08f0a70aa2f
SHA256

4053fac7d1f27b13cd7556fa512a90773b38819a2b5fee9afe26ae7628a8e155
SHA512

e44cbcfd44affd5a84ff1853e050ee4da81ae708a79f36ad253990f6d3d7c5bcd82c7dcd6010ebc59f11f86bb6bac1665a171076a2f704e5fe900ea194309380
SSDEEP

1536:AByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8WD:dv4JKXTx71wnArSsXFpeXq8WD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\615275bc0025bea13692fb0648ee1f30_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\615275bc0025bea13692fb0648ee1f30_NeikiAnalytics.dll,#1
  2⤵
  PID:2720