13763712369768a51ab91e4425d94a8d395c6f532b1fe135b3c89650eb4bf4e7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 14:30

Target

f950d29b4f8513a56871a67621d55110_NeikiAnalytics.dll
Size

48KB
MD5

f950d29b4f8513a56871a67621d55110
SHA1

a06fb844b7996b5fb150a2df9e2227b2897e126b
SHA256

13763712369768a51ab91e4425d94a8d395c6f532b1fe135b3c89650eb4bf4e7
SHA512

0c3932f4115bb11afd265520a27339642c1fa58d14cc466222e2b8f2afedc297c575d2471797d6ac3f6cde875eecf8047d87692811fc92119d0477af57ffdb77
SSDEEP

768:HNA3giFTqVvJg0Ma4RqjwnbLOM9muoAMW:HjiFTqfgqknbx7o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	2296	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2296	2228	rundll32.exe	28
PID 2228 wrote to memory of 2296	2228	rundll32.exe	28
PID 2228 wrote to memory of 2296	2228	rundll32.exe	28
PID 2228 wrote to memory of 2296	2228	rundll32.exe	28
PID 2228 wrote to memory of 2296	2228	rundll32.exe	28
PID 2228 wrote to memory of 2296	2228	rundll32.exe	28
PID 2228 wrote to memory of 2296	2228	rundll32.exe	28
PID 2296 wrote to memory of 2212	2296	rundll32.exe	29
PID 2296 wrote to memory of 2212	2296	rundll32.exe	29
PID 2296 wrote to memory of 2212	2296	rundll32.exe	29
PID 2296 wrote to memory of 2212	2296	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f950d29b4f8513a56871a67621d55110_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f950d29b4f8513a56871a67621d55110_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 224
    3⤵
    - Program crash
    PID:2212