53fcc46b69f7e8d0b677eab3db44e385cef4d7febac68b18e46c6a9cc3a28fa2

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 14:30

Target

3f426a8819b02e9f09310dd928adb410_NeikiAnalytics.dll
Size

54KB
MD5

3f426a8819b02e9f09310dd928adb410
SHA1

39443e8870713d64014917f1ef1aa63c9962e630
SHA256

53fcc46b69f7e8d0b677eab3db44e385cef4d7febac68b18e46c6a9cc3a28fa2
SHA512

68f66993a31eacd71ca541aa015d01f31d231e010d92f25f61fa0601a1026e5f5c4e57a709678235b1502fe14b342673a580d5cf7ce6ead3312141a1a8f80738
SSDEEP

768:yT/x/2wgck0P6aNvZH6IfTnl5R4wFVLpBQIoh7Rnbqab3GbY:c6F+fbnRXVBQ/Xv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 1724	2480	rundll32.exe	28
PID 2480 wrote to memory of 1724	2480	rundll32.exe	28
PID 2480 wrote to memory of 1724	2480	rundll32.exe	28
PID 2480 wrote to memory of 1724	2480	rundll32.exe	28
PID 2480 wrote to memory of 1724	2480	rundll32.exe	28
PID 2480 wrote to memory of 1724	2480	rundll32.exe	28
PID 2480 wrote to memory of 1724	2480	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f426a8819b02e9f09310dd928adb410_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f426a8819b02e9f09310dd928adb410_NeikiAnalytics.dll,#1
  2⤵
  PID:1724