5528bb04607b5cdd69b36c806bbf840b3c44a7255d24eeadd08eeaef6b5d8be1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 00:02

Target

5ba3669221d38c3844565089aaa9d790_NeikiAnalytics.dll
Size

6KB
MD5

5ba3669221d38c3844565089aaa9d790
SHA1

396aa6201ff30e5fb19f67256a5b8ebf26213fe9
SHA256

5528bb04607b5cdd69b36c806bbf840b3c44a7255d24eeadd08eeaef6b5d8be1
SHA512

6cfc78a80f5f056f67f0fa2311da34a1d6b6453373f2439de5767198c05aea73c101fa3830676c7bff335027a282d644b653f152cca35c5e6b7d81c23ce499f3
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqqgYwJKIHUoGJSwJO+L:hy859x0P8MaqxwJao+LO+L

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2756	2028	rundll32.exe	28
PID 2028 wrote to memory of 2756	2028	rundll32.exe	28
PID 2028 wrote to memory of 2756	2028	rundll32.exe	28
PID 2028 wrote to memory of 2756	2028	rundll32.exe	28
PID 2028 wrote to memory of 2756	2028	rundll32.exe	28
PID 2028 wrote to memory of 2756	2028	rundll32.exe	28
PID 2028 wrote to memory of 2756	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ba3669221d38c3844565089aaa9d790_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ba3669221d38c3844565089aaa9d790_NeikiAnalytics.dll,#1
  2⤵
  PID:2756