aeda054f4f4c683b0af85b96f1919b83c48735dcc857c4d8fd47e8ba4fa10594

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 00:08

Target

5bce7975fc1eaca461cc49759e516130_NeikiAnalytics.dll
Size

17KB
MD5

5bce7975fc1eaca461cc49759e516130
SHA1

66a82c14bd9ab08954885318c94669ae87eb9edd
SHA256

aeda054f4f4c683b0af85b96f1919b83c48735dcc857c4d8fd47e8ba4fa10594
SHA512

4ce88f90203e0fef865a8201675d75b4a50b5f50e9a5c503b373468166819b8caf4f02180332b0f899a749803c1832b3239c98685bd2450d948c0380d4ebf03a
SSDEEP

384:ZZXaW+DxObe9wohqsZ4SH2IbK7jiwaNCUnlXqoSc6+RmUxg/+Fg/:DKeEwo8seSHnYiwQvFqoSc6+8Eg2Fw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1752	640	rundll32.exe	28
PID 640 wrote to memory of 1752	640	rundll32.exe	28
PID 640 wrote to memory of 1752	640	rundll32.exe	28
PID 640 wrote to memory of 1752	640	rundll32.exe	28
PID 640 wrote to memory of 1752	640	rundll32.exe	28
PID 640 wrote to memory of 1752	640	rundll32.exe	28
PID 640 wrote to memory of 1752	640	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bce7975fc1eaca461cc49759e516130_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bce7975fc1eaca461cc49759e516130_NeikiAnalytics.dll,#1
  2⤵
  PID:1752