387353436bc342b9eb86e644a54bf3eece5b6299685f9916841b5fbf0034c078

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 20:37

Target

1cc177f7700f0258279a71944e9e22d0_NeikiAnalytics.dll
Size

81KB
MD5

1cc177f7700f0258279a71944e9e22d0
SHA1

834fcc2511120716477ec43fb11551681cf9cc16
SHA256

387353436bc342b9eb86e644a54bf3eece5b6299685f9916841b5fbf0034c078
SHA512

14ec4f31065019a7a3c27d6dcd4279bb76fb524a91d67517a5c6190c086326ff3d17427bc26bb004ef0d2c3441039d6a7f09bcdf7ef897463354b81620573e15
SSDEEP

1536:LByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Wu:Kv4JKXTx71wnArSsXFpeXq8Wu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cc177f7700f0258279a71944e9e22d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cc177f7700f0258279a71944e9e22d0_NeikiAnalytics.dll,#1
  2⤵
  PID:1052