5582dbe625d86c6ebb4d9c6eb4a4e92a97d5a566135eec76af2c75243cef101e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 23:47

Target

0d905f2155dd1ccafd9a27ebf4e55eb0_NeikiAnalytics.dll
Size

68KB
MD5

0d905f2155dd1ccafd9a27ebf4e55eb0
SHA1

0b807dd47faba7cf3b8c7a7b52a8840e57499223
SHA256

5582dbe625d86c6ebb4d9c6eb4a4e92a97d5a566135eec76af2c75243cef101e
SHA512

c0de4a4fe7776565882ab55d603c03b685b82c1facbd372c20eea16a6808e6c6e4a9674dd54110457a88b899f7e0c97dc3bae5fb6b8daf87349f435f0649a461
SSDEEP

1536:MLNd/Pk7btaoX7DypKr0wNuYIUSS9eyBYBW0iZs3L:GNhY5aora80muYI7DBWXs3

Score

7^/10

Drops startup file 1 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dcxfecjk.exe	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1544 wrote to memory of 1548	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1548	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1548	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1548	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1548	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1548	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1548	1544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d905f2155dd1ccafd9a27ebf4e55eb0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d905f2155dd1ccafd9a27ebf4e55eb0_NeikiAnalytics.dll,#1
  2⤵
  - Drops startup file
  PID:1548

memory/1548-3-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1548-2-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1548-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1548-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download