721cd951a9ed525aaf1dd43f4114ce799275a6098cd633d8911c0bdcaf03d58f

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 20:10

Target

1852ed78c933d9426f68de39b11742f0_NeikiAnalytics.dll
Size

152KB
MD5

1852ed78c933d9426f68de39b11742f0
SHA1

488d49ec4f95f83e7ed04102e830e9fc5fd09bf1
SHA256

721cd951a9ed525aaf1dd43f4114ce799275a6098cd633d8911c0bdcaf03d58f
SHA512

b7bb7690079f9de2d82ff75a99fe3c3409adf3d32a7eea3d4e6506c9b9b4507e738c9d0c74c804d68f96f29f92f5f3ec5a20b40167f11c6f5187b813e479c16f
SSDEEP

3072:J7+5EpeJE1P6YTrbUXruOKDhGOtTTBftdPY2:J7JNbbUXr+D7tTTBldPY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2056 wrote to memory of 2748	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2748	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2748	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2748	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2748	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2748	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2748	2056	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1852ed78c933d9426f68de39b11742f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1852ed78c933d9426f68de39b11742f0_NeikiAnalytics.dll,#1
2⤵
PID:2748