0b031b30fb950cdf7b2f2e129a75f11f067b3538825b5fc0035cc90ecaa27863

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 22:07

Target

075d24d49435f95bd3b581a7175d9d10_NeikiAnalytics.dll
Size

6KB
MD5

075d24d49435f95bd3b581a7175d9d10
SHA1

803c59ab60d4e40dccce9d6ff8489d65b70f50a1
SHA256

0b031b30fb950cdf7b2f2e129a75f11f067b3538825b5fc0035cc90ecaa27863
SHA512

7dca649be6ad56f511bdf0259d9eb3e842cc069bca7b85786a76c19aa238110ba56b4aba7bc548a35254b315af5b897ccbe2dacd9e9702646e408d2c5c2c9189
SSDEEP

96:nEY2RrF1eqwi4tFDP2e38BMTMWpBi5SPn3aeZN:EHRh1eppv1Pbi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1456	2236	rundll32.exe	28
PID 2236 wrote to memory of 1456	2236	rundll32.exe	28
PID 2236 wrote to memory of 1456	2236	rundll32.exe	28
PID 2236 wrote to memory of 1456	2236	rundll32.exe	28
PID 2236 wrote to memory of 1456	2236	rundll32.exe	28
PID 2236 wrote to memory of 1456	2236	rundll32.exe	28
PID 2236 wrote to memory of 1456	2236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\075d24d49435f95bd3b581a7175d9d10_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\075d24d49435f95bd3b581a7175d9d10_NeikiAnalytics.dll,#1
  2⤵
  PID:1456