ccf24bdadb8343dbd098f1382f47a7343a89b12761606bb5ad7c9c7b694bec5f

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 20:37

Target
1915f28fd2eeec1b31d11f5d55ce1390_NeikiAnalytics.dll
Size 426KB
Sample240527-zelasaae47
SHA256 ccf24bdadb8343dbd098f1382f47a7343a89b12761606bb5ad7c9c7b694bec5f
MD5 1915f28fd2eeec1b31d11f5d55ce1390
SHA1 f5fa0d3279610e5c007953c1e977814b7d82ef5a
SHA512 6eea37ae5f09b7c75f656a798934c10c9196ae6003c0f7fa270f2c78234958cdb41f8aa6957c78c41bcba6bcef644e7cc102562c112fae0eba9b67bf073a9822
SSDEEP 12288:sJHAVNmyaGKEszBj+MnS3GbFjxPBzWGITqYXOVOoQM:WgWljJBbF1ZzWGIO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1915f28fd2eeec1b31d11f5d55ce1390_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1915f28fd2eeec1b31d11f5d55ce1390_NeikiAnalytics.dll,#1
  2⤵
  PID:1960