2df458a1c41b44fff01c11fc6f1158b66aa5b0f02a5eff6829b7db062ad1f840

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 05:04

Target

28921e34643019bd270acb64c57cd6c0_NeikiAnalytics.dll
Size

22KB
MD5

28921e34643019bd270acb64c57cd6c0
SHA1

2e7efaf77b2b00e0268f5ac53cc826b95c892a7b
SHA256

2df458a1c41b44fff01c11fc6f1158b66aa5b0f02a5eff6829b7db062ad1f840
SHA512

b339dcf21c89102ff69278f6efc4a90a8490cfe12f791e0a0e085a0ca61e5dda06c335392a69b63b395daebc9b1a2dfdd918a1300eb32a3db36eee33dc30a29d
SSDEEP

384:+H/lOYQwgGpYiP7mNJk5WMbyM6j4dzMdrZ6TYnYPLQjyIANweMw1y:+9Y+7mNJ6WMbP84NeFC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28921e34643019bd270acb64c57cd6c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28921e34643019bd270acb64c57cd6c0_NeikiAnalytics.dll,#1
  2⤵
  PID:2256