16e2e0e2662788a5564481a0560eac9755ae13958332ce836d1c215b0a7c1179

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 01:31

Target

279df63f955fd021b72865321317f730_NeikiAnalytics.dll
Size

7KB
MD5

279df63f955fd021b72865321317f730
SHA1

47e73a2bcec27c05eddd3a4a4d27ff7a202c3e0a
SHA256

16e2e0e2662788a5564481a0560eac9755ae13958332ce836d1c215b0a7c1179
SHA512

34825ea7e9d7fb0544a8bb79b16f027480630b5a4ac8b8b6c7a14a95e35d412ac986cba13040c1fda9432ab5f31cfae48d229eadbb73c79d86d4720b092a6ab7
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4R7cBlmS/88NPb91nkzJd4kjd9+:2M/SdjbgYK7cDmSnNPb/ktn9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\279df63f955fd021b72865321317f730_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\279df63f955fd021b72865321317f730_NeikiAnalytics.dll,#1
  2⤵
  PID:1936