3ff8d88c131164e8974f52fd8aea77b69b61f62346c0b7934b268bac348b9b95

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 22:09

Target

57bb4a3cee7fc51cecc8843d6220b370_NeikiAnalytics.dll
Size

395KB
MD5

57bb4a3cee7fc51cecc8843d6220b370
SHA1

a4783c2b9bdd97ae718c969905af9aa4acab2edc
SHA256

3ff8d88c131164e8974f52fd8aea77b69b61f62346c0b7934b268bac348b9b95
SHA512

148f2784f1da1666d7189212a17fff160ba0ac28ac5d10948f718d957205473b96e4304de8307bdc3cd388977591af0028b010aad7db2e2875e3a4f229514d2e
SSDEEP

6144:K6oUipBmTKu5bdaUBA/Q6brYpK5h2z7X6i7VPncC58ThCEWV50DEruAOPM2t:6C/0XQ6bEsLYco81RZDRtM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57bb4a3cee7fc51cecc8843d6220b370_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57bb4a3cee7fc51cecc8843d6220b370_NeikiAnalytics.dll,#1
  2⤵
  PID:1820