d038c5cca9dd21907fb0a5c6fbe3595b01f2034005e2de62fe991ebfb281c871

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 00:13

Target

6e89068cb8257c69d5bc307d25ec98f0_NeikiAnalytics.dll
Size

81KB
MD5

6e89068cb8257c69d5bc307d25ec98f0
SHA1

ff3a5cb2c62f82e2303622a6cbdeab6a30b66c44
SHA256

d038c5cca9dd21907fb0a5c6fbe3595b01f2034005e2de62fe991ebfb281c871
SHA512

add81664c41bfda42544fa0270740c1f12e086160241ea3885c827e0706a434127fe4df1c4d09494eafacac9482d9596d05b5fdbc8f8a8de37a5cf7a1bf40a70
SSDEEP

1536:ItByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WJ:I4v4JKXTx71w0ArSsXF3enq8WJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e89068cb8257c69d5bc307d25ec98f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e89068cb8257c69d5bc307d25ec98f0_NeikiAnalytics.dll,#1
  2⤵
  PID:2352