bb789b62ece1060c105c64d70f18f3d03a9e6b757403b2c8b643eb1c511b776b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 19:27

Target

313a9a3bb6b1e03248ef2050dbcefc70_NeikiAnalytics.dll
Size

44KB
MD5

313a9a3bb6b1e03248ef2050dbcefc70
SHA1

a83beeec326637413d5d8024ca2668eaf32c5bd5
SHA256

bb789b62ece1060c105c64d70f18f3d03a9e6b757403b2c8b643eb1c511b776b
SHA512

7f190087ab1bfd28ae22c21ddfa963584384a4e4f5cc06c6813cca29b4a70db98064fc7a01cd90863ce3b1d8586bc32f0845313145822938d466b77e92b652c3
SSDEEP

384:fYJVovJ4MvbDGnJSdm7njyaNHLgyHhopymLZqDZeRM5UynD:fYJVm48DOckjyaNrgyHh6Fc8RM5HnD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2412	1596	rundll32.exe	28
PID 1596 wrote to memory of 2412	1596	rundll32.exe	28
PID 1596 wrote to memory of 2412	1596	rundll32.exe	28
PID 1596 wrote to memory of 2412	1596	rundll32.exe	28
PID 1596 wrote to memory of 2412	1596	rundll32.exe	28
PID 1596 wrote to memory of 2412	1596	rundll32.exe	28
PID 1596 wrote to memory of 2412	1596	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\313a9a3bb6b1e03248ef2050dbcefc70_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\313a9a3bb6b1e03248ef2050dbcefc70_NeikiAnalytics.dll,#1
  2⤵
  PID:2412