c85577614f5bf62c82399b13bf3e2073fc0bf94c67c620b46e713d77aabb0661

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 11:04

Target

409c5dde133ea32b8a940c97227f3e70_NeikiAnalytics.dll
Size

329KB
MD5

409c5dde133ea32b8a940c97227f3e70
SHA1

377ccf86253c210da89ff3e184c54e1cf190f4c8
SHA256

c85577614f5bf62c82399b13bf3e2073fc0bf94c67c620b46e713d77aabb0661
SHA512

c167629fd5928ff37879465bd690c92c24d2148a4dc80a7cfb5cfa603c1d6866077e4789bace91976d197cfc24626eb683b41118176473ec64e6a748f04d16cd
SSDEEP

6144:RmWhxR1arY/PbgmFOabPIIBhJXAv7eTY9suz0xhttGSrDKE3KIvSka8bO:RmWTR1arYnEKosuzY34CZ3DvSkN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1784	2204	rundll32.exe	28
PID 2204 wrote to memory of 1784	2204	rundll32.exe	28
PID 2204 wrote to memory of 1784	2204	rundll32.exe	28
PID 2204 wrote to memory of 1784	2204	rundll32.exe	28
PID 2204 wrote to memory of 1784	2204	rundll32.exe	28
PID 2204 wrote to memory of 1784	2204	rundll32.exe	28
PID 2204 wrote to memory of 1784	2204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\409c5dde133ea32b8a940c97227f3e70_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\409c5dde133ea32b8a940c97227f3e70_NeikiAnalytics.dll,#1
  2⤵
  PID:1784