6174a7439894a7d399d58de5139bb89d9b5446ae04e5ea5fa36c9c71c333726e

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 21:49

Target

6f5da6830ec4ccc964278a80372c6870_NeikiAnalytics.dll
Size

6KB
MD5

6f5da6830ec4ccc964278a80372c6870
SHA1

797eeee5ee84d154c2946eb877e81b678a5f5c1d
SHA256

6174a7439894a7d399d58de5139bb89d9b5446ae04e5ea5fa36c9c71c333726e
SHA512

a4b64dc85f4918765f3d752ee9a67548fae42785455951af024a3160737f9d591e8d8e909ebbcd4a56d3ec3fd9554cdf2c244a693cb425b22371c7cd4d047bda
SSDEEP

96:hy859x0P8MaHUtyVL2JPswmR+6pe0rWG9drBP/dw6RmqQZsxaU:F5oLvYLwswmR+iTWG9d93dw6Rmqisj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f5da6830ec4ccc964278a80372c6870_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f5da6830ec4ccc964278a80372c6870_NeikiAnalytics.dll,#1
  2⤵
  PID:2468