bd8694b7a638e9f45fce931699f806ddbfd9e3ab356027f509cdd611be62f978

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 01:13

Target

5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll
Size

94KB
MD5

5e177b1a18e0831839f8bbc08c1de620
SHA1

8352fea352e99c31040f071d2cd45d382c89a3bf
SHA256

bd8694b7a638e9f45fce931699f806ddbfd9e3ab356027f509cdd611be62f978
SHA512

1b4730c95e27671086555850f919e1d4264c5a1d70af9a4a2a2ccd2ee03d56f3439d6edc5ac256e7e42f1975fcae4d6316f0d5dae100127d32b8ba054b077ced
SSDEEP

1536:nx52vQBKLmh4jIUs7ghzerjJC8kVidxfUjQRKr2nTWExTOojRO:nxIvQBK+7rghzSLkIdxfmQ0oTOoj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	2040	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2040	1680	rundll32.exe	28
PID 1680 wrote to memory of 2040	1680	rundll32.exe	28
PID 1680 wrote to memory of 2040	1680	rundll32.exe	28
PID 1680 wrote to memory of 2040	1680	rundll32.exe	28
PID 1680 wrote to memory of 2040	1680	rundll32.exe	28
PID 1680 wrote to memory of 2040	1680	rundll32.exe	28
PID 1680 wrote to memory of 2040	1680	rundll32.exe	28
PID 2040 wrote to memory of 2464	2040	rundll32.exe	29
PID 2040 wrote to memory of 2464	2040	rundll32.exe	29
PID 2040 wrote to memory of 2464	2040	rundll32.exe	29
PID 2040 wrote to memory of 2464	2040	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 224
    3⤵
    - Program crash
    PID:2464