b3cf0c877c2e47a85c7ba9edffdffcc23c294057c1ec7129599f25bfff0c5918

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 23:34

Target

6d244907e1708d12201753eb0c8f72e0_NeikiAnalytics.dll
Size

329KB
MD5

6d244907e1708d12201753eb0c8f72e0
SHA1

9fd966ff0abfc7530b1e79f2d0936a594dcdced9
SHA256

b3cf0c877c2e47a85c7ba9edffdffcc23c294057c1ec7129599f25bfff0c5918
SHA512

48d156b42207fd3b3f9a61d8e227b233483fd1d512a97ec90f9f65194845fb2d368f245bf1a0ee355602e0a2adc8f3d714ff1940cea8746d018417bc389c1a48
SSDEEP

6144:RmWhxR1arY/PbgmFOabPIIBhJXAv7eTY9suz0xhttGSrDKE3KIvSka8be:RmWTR1arYnEKosuzY34CZ3DvSkN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1900	1616	rundll32.exe	28
PID 1616 wrote to memory of 1900	1616	rundll32.exe	28
PID 1616 wrote to memory of 1900	1616	rundll32.exe	28
PID 1616 wrote to memory of 1900	1616	rundll32.exe	28
PID 1616 wrote to memory of 1900	1616	rundll32.exe	28
PID 1616 wrote to memory of 1900	1616	rundll32.exe	28
PID 1616 wrote to memory of 1900	1616	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d244907e1708d12201753eb0c8f72e0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d244907e1708d12201753eb0c8f72e0_NeikiAnalytics.dll,#1
  2⤵
  PID:1900