6916ad2325133c7de88fbd0849d98a3c365d2e3ae8fda9898334b4b365396c92

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 01:17

Target

2b1750f3a04f0889599bb1027fc1b640_NeikiAnalytics.dll
Size

491KB
MD5

2b1750f3a04f0889599bb1027fc1b640
SHA1

48c097de5b423080e5862d2fabbdc9e260df25b9
SHA256

6916ad2325133c7de88fbd0849d98a3c365d2e3ae8fda9898334b4b365396c92
SHA512

88d9d368e489a1d2488628d358a8dae25184b1edb7555a8883e43f164041dc67a34b18cc1b468276a03e679f746bf7e842e8ea706a6a2fb08356e065096c196e
SSDEEP

12288:Xl/bSK7+JaIBV45d36lgOkxE45ZAQrenObOZahVkDVbpTUiwL:wDBmaQX3hGDV1Tpw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b1750f3a04f0889599bb1027fc1b640_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b1750f3a04f0889599bb1027fc1b640_NeikiAnalytics.dll,#1
  2⤵
  PID:1512