77ddcba6e0e514a38ab6ecf9c866b8c2dcaf3818186301a8e0dff447be943c6e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 04:21

Target

64a8d45734358a7fda23d3690a651a00_NeikiAnalytics.dll
Size

327KB
MD5

64a8d45734358a7fda23d3690a651a00
SHA1

e730c3ecff586bf373f60a214fd4053ee0f28af8
SHA256

77ddcba6e0e514a38ab6ecf9c866b8c2dcaf3818186301a8e0dff447be943c6e
SHA512

63e32e9c1d955020316fd9bf4a9858685abd8a3eaf113118015fb3e2a9b781d6cbe536ff91d279c855dfedd09843bcc4eb86b091baa0799280283e0cba351660
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64a8d45734358a7fda23d3690a651a00_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64a8d45734358a7fda23d3690a651a00_NeikiAnalytics.dll,#1
  2⤵
  PID:2176