bebedd16b452a96d03e38ac4ac6c1f5ba369b9990e32f77ded76e1b5c48f9600

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 18:48

Target

580315ca5510d2a9e090fef7893a94d0_NeikiAnalytics.dll
Size

265KB
MD5

580315ca5510d2a9e090fef7893a94d0
SHA1

576cca7b017a2f1e41e3888763f2ce86c1708a4b
SHA256

bebedd16b452a96d03e38ac4ac6c1f5ba369b9990e32f77ded76e1b5c48f9600
SHA512

51ae5416866d701beed1bb1747d236c822fa14f0c003399101dadc7bdfe769a869fcac00ef556727bb703edd48c89b70add005b36cc1225b5ef0ec6a08516f16
SSDEEP

3072:x/nmZ9MI5FttciXroM/SzDxEtvSPuRMRLZaHCj0WGnpW9NV6VBc7BZbNVgq1Sff8:x/nwFt6iXUMWpwmNV6Vu7b053TBZ/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2324	2908	rundll32.exe	28
PID 2908 wrote to memory of 2324	2908	rundll32.exe	28
PID 2908 wrote to memory of 2324	2908	rundll32.exe	28
PID 2908 wrote to memory of 2324	2908	rundll32.exe	28
PID 2908 wrote to memory of 2324	2908	rundll32.exe	28
PID 2908 wrote to memory of 2324	2908	rundll32.exe	28
PID 2908 wrote to memory of 2324	2908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\580315ca5510d2a9e090fef7893a94d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\580315ca5510d2a9e090fef7893a94d0_NeikiAnalytics.dll,#1
  2⤵
  PID:2324