2788fe8bd21f5182d4b66d5417fcf70c8651b3b3514f2ae7862a45565a56edeb

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 07:40

Target

3f2bf20daf52185c8b02348b5ee3dde0_NeikiAnalytics.dll
Size

327KB
MD5

3f2bf20daf52185c8b02348b5ee3dde0
SHA1

a9160700d160bf61710cb6d870ac107ac4b1c95a
SHA256

2788fe8bd21f5182d4b66d5417fcf70c8651b3b3514f2ae7862a45565a56edeb
SHA512

727629cfe714199f789648bb5cca40f536bff6b1cd0eb6c49864b1544442ccc69dd18658a94ee5649e42ffcfe8b9954ede7dda31cda606b86ce15f360e9f2ed5
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f2bf20daf52185c8b02348b5ee3dde0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f2bf20daf52185c8b02348b5ee3dde0_NeikiAnalytics.dll,#1
  2⤵
  PID:2488