f84bba718eda2259138aadcf080d3943847390e307b9804d3b54fb8c4be5d2ed

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 09:08

Target

4e73bb040a8b5ab441023ee7d3e29460_NeikiAnalytics.dll
Size

22KB
MD5

4e73bb040a8b5ab441023ee7d3e29460
SHA1

eb3bcb158f9a378e5dacfe0027d58479eb386183
SHA256

f84bba718eda2259138aadcf080d3943847390e307b9804d3b54fb8c4be5d2ed
SHA512

6e4c3a751cce1128e2dbeda09a816c4c9e36926b3469f8c231a0623fb001a2ba5e85bfefd60eaf8a26ee80e8c68dbe64e697d710eca5db36f458f70b8ecb5e76
SSDEEP

384:+Vjgya6H7GaDd0JUGbsYlxh5tawKrwwXEgZ28uo3ydLyU93OO3kkP:+L7G9HhHawKrDB2No3O93r

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2444	2480	rundll32.exe	28
PID 2480 wrote to memory of 2444	2480	rundll32.exe	28
PID 2480 wrote to memory of 2444	2480	rundll32.exe	28
PID 2480 wrote to memory of 2444	2480	rundll32.exe	28
PID 2480 wrote to memory of 2444	2480	rundll32.exe	28
PID 2480 wrote to memory of 2444	2480	rundll32.exe	28
PID 2480 wrote to memory of 2444	2480	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e73bb040a8b5ab441023ee7d3e29460_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e73bb040a8b5ab441023ee7d3e29460_NeikiAnalytics.dll,#1
  2⤵
  PID:2444