ce89541fb1a643fc3e23cda771045a405b1e4febb507bd35366669aca389521c

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 06:51

Target

4b514cdebea4df203015005bb82fb250_NeikiAnalytics.dll
Size

81KB
MD5

4b514cdebea4df203015005bb82fb250
SHA1

1a62992b39ad21d6c0cbd646da019c6fc6485a68
SHA256

ce89541fb1a643fc3e23cda771045a405b1e4febb507bd35366669aca389521c
SHA512

791f04eb3b56af167c38310abef1a5b99bf4386708cd3833295078f0ebcc2dab17cbfa7a5838def3b03999b2d43e126f7dcdc61f04bea18402de04867cb59b5a
SSDEEP

1536:K9ER9ve+HW4A6yKr7ownTxgAJnPKwuUSoosWaocdBSheDQU+GZ:QEe0zA6yKFdgC/RBSheDQU+6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b514cdebea4df203015005bb82fb250_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b514cdebea4df203015005bb82fb250_NeikiAnalytics.dll,#1
  2⤵
  PID:1968