ccf12a0c99af6160a40be585af145f1fac7956abd113b0b8c6648988a18937c7

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 00:18

Target
8a584656cff931df0d9dd19c0f72b3a0_NeikiAnalytics.dll
Size 83KB
Sample240603-aly3sadf39
SHA256 ccf12a0c99af6160a40be585af145f1fac7956abd113b0b8c6648988a18937c7
MD5 8a584656cff931df0d9dd19c0f72b3a0
SHA1 36b63dd2a25eeecd15010d8b36276f7c82b4bd2c
SHA512 a1b8c8a2da9ebbe4624dab937723dcb91b75b5cc1b3b025312a38721e70fd431dc968b97d139404ac693e9d42674e6a20cbd070134fe79e62d145a6c4ffe3d42
SSDEEP 1536:5JAooe4Y8mEScroVd0O/KaTHgMLXnrtGqtk5B6:TArE8pQH5tk5k
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2944	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 2944 wrote to memory of 2916	2944	rundll32.exe	29
PID 2944 wrote to memory of 2916	2944	rundll32.exe	29
PID 2944 wrote to memory of 2916	2944	rundll32.exe	29
PID 2944 wrote to memory of 2916	2944	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a584656cff931df0d9dd19c0f72b3a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a584656cff931df0d9dd19c0f72b3a0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 244
    3⤵
    - Program crash
    PID:2916