8a107901f3d1ce9ff9703e1f7ad52c44746b27eeea81336305ac91f5d0d05345

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 17:59

Target

4f6976465a89cd19df0c85e780fb3f70_NeikiAnalytics.dll
Size

1000KB
MD5

4f6976465a89cd19df0c85e780fb3f70
SHA1

be198839e968f6677b755e8315e033dd965140c4
SHA256

8a107901f3d1ce9ff9703e1f7ad52c44746b27eeea81336305ac91f5d0d05345
SHA512

9169db3252e806754722f6974b6b20e20d5917b596618758dca7c588a2f2bc6016c83e2c4bd95476d5c4c803f7b8e213879a30cf4f712177bc7fdfdf6f6f4feb
SSDEEP

24576:4vD83LQ4taea1VU7LDYBlSHswr/LqRvHLu:u1vSV/LqR/6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2052	2912	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 2912 wrote to memory of 2052	2912	rundll32.exe	29
PID 2912 wrote to memory of 2052	2912	rundll32.exe	29
PID 2912 wrote to memory of 2052	2912	rundll32.exe	29
PID 2912 wrote to memory of 2052	2912	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f6976465a89cd19df0c85e780fb3f70_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f6976465a89cd19df0c85e780fb3f70_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 260
    3⤵
    - Program crash
    PID:2052

memory/2912-0-0x0000000001DB0000-0x0000000001EB5000-memory.dmp

Filesize
1.0MB

Download
memory/2912-1-0x0000000001DB0000-0x0000000001EB5000-memory.dmp

Filesize
1.0MB

Download