bbf25055134f5d84c0be824dc28f1020a6ca6377bf820bf2c140ba98d6c5a46c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 12:15

Target

b5865f2fd7ef42ddfbde9c6b70d1cef0_NeikiAnalytics.dll
Size

6KB
MD5

b5865f2fd7ef42ddfbde9c6b70d1cef0
SHA1

dedf17934e8e1eabc922d2f97cb1b6e0d1a6c8b2
SHA256

bbf25055134f5d84c0be824dc28f1020a6ca6377bf820bf2c140ba98d6c5a46c
SHA512

644188592938c0ab429dff5ca6bf3e14b1f64b10411cb9ce3b78424333a493660d549a8bc12c30023344fe12b8919fcedd3bd4f4d8287451ab3c8e8c99b5d876
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqVs4aO2uGF1e08pKeK4gKfX/IzOMFZzG91m:hy859x0P8MaoQ0g1yJiHOCWfi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2984	1680	rundll32.exe	28
PID 1680 wrote to memory of 2984	1680	rundll32.exe	28
PID 1680 wrote to memory of 2984	1680	rundll32.exe	28
PID 1680 wrote to memory of 2984	1680	rundll32.exe	28
PID 1680 wrote to memory of 2984	1680	rundll32.exe	28
PID 1680 wrote to memory of 2984	1680	rundll32.exe	28
PID 1680 wrote to memory of 2984	1680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5865f2fd7ef42ddfbde9c6b70d1cef0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5865f2fd7ef42ddfbde9c6b70d1cef0_NeikiAnalytics.dll,#1
  2⤵
  PID:2984