3ce0ee5987566fb6d2bf1b702dfaa5c7cf618290d059991194c246c8bb02fd3d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 16:01

Target

060821943fec420f6404e1d919a71dd0_NeikiAnalytics.dll
Size

327KB
MD5

060821943fec420f6404e1d919a71dd0
SHA1

e6aa5161e8d5876ef9c6880e569f4b0fd32c2cb8
SHA256

3ce0ee5987566fb6d2bf1b702dfaa5c7cf618290d059991194c246c8bb02fd3d
SHA512

e6b7bf70089df72c1cf8960880d5f83ae41a982aef78476c180b9560ba17087ae49338164e791c2925668876ee970e3a5ee24cf8e21cf45af51f06ea5cdcdeef
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\060821943fec420f6404e1d919a71dd0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\060821943fec420f6404e1d919a71dd0_NeikiAnalytics.dll,#1
  2⤵
  PID:2004