6f6302ef6bf90e48ec716477e770fc12a77ba0da14ff2f5ab8e8f6b05f13a64c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 01:56

Target

4d56c9d8ae92d68bf83726c9949b3700_NeikiAnalytics.dll
Size

81KB
MD5

4d56c9d8ae92d68bf83726c9949b3700
SHA1

89131f33fa04decfa6f369d0b17c2e6a463cbc6a
SHA256

6f6302ef6bf90e48ec716477e770fc12a77ba0da14ff2f5ab8e8f6b05f13a64c
SHA512

8c677caa7883c337ee4b5f9072032fd5bf88856e02fb9a55da58e6fe4b5b424b517c7e06cd8ebb3ddfebf435adbd813b8f0688d0248c068bc26ef950498ce882
SSDEEP

1536:5ByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8W6:Ev4JKXTx71wnArSsXFpeXq8W6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2012	1848	rundll32.exe	28
PID 1848 wrote to memory of 2012	1848	rundll32.exe	28
PID 1848 wrote to memory of 2012	1848	rundll32.exe	28
PID 1848 wrote to memory of 2012	1848	rundll32.exe	28
PID 1848 wrote to memory of 2012	1848	rundll32.exe	28
PID 1848 wrote to memory of 2012	1848	rundll32.exe	28
PID 1848 wrote to memory of 2012	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d56c9d8ae92d68bf83726c9949b3700_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d56c9d8ae92d68bf83726c9949b3700_NeikiAnalytics.dll,#1
  2⤵
  PID:2012