caa29879d72f2fbf511ede0b7bf28c7cdc0dc4f3255c115e61b1566d67ef5806

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 05:15

Target

6eeb075d20a66aa150ae5e1d81f6a620_NeikiAnalytics.dll
Size

327KB
MD5

6eeb075d20a66aa150ae5e1d81f6a620
SHA1

e46109323b819383373e4492cef2040f733b211a
SHA256

caa29879d72f2fbf511ede0b7bf28c7cdc0dc4f3255c115e61b1566d67ef5806
SHA512

23a5460322ed9af2a9a2d65453f32215b1a7d35e40983d29178c4a9720ac27896ea242d3aa6147c0bc04b482a8b5799480828cbc2ae144ed82ca9f63139a6851
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6eeb075d20a66aa150ae5e1d81f6a620_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6eeb075d20a66aa150ae5e1d81f6a620_NeikiAnalytics.dll,#1
  2⤵
  PID:1120