ac9225f021edae791d66a2d7191f60e42a28c708f6d3a67961828500254dbb16

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 07:45

Target

2d0064b2169ddd4efeffeed9628b6490_NeikiAnalytics.dll
Size

294KB
MD5

2d0064b2169ddd4efeffeed9628b6490
SHA1

7c32b6ae4fdd56ba935d17bc71a420b621a9213c
SHA256

ac9225f021edae791d66a2d7191f60e42a28c708f6d3a67961828500254dbb16
SHA512

c1997058458498d942d265e9980b76a54b263e0d41da88863cb8c31e9dda87b4289b2dba3477b7ca8b751beb015d4d7e54ff6975ab45114bf577ea169f039d69
SSDEEP

1536:k+dd2dhuj7NLNirpvpyNEfFuWH+dKY0UIIF+yZ0zBEcb5BToWqCLpp6IK+2rEpka:rddyQNLQa+F9hyZ+//9prZ2h87eVy+Zc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1852	2444	rundll32.exe	28
PID 2444 wrote to memory of 1852	2444	rundll32.exe	28
PID 2444 wrote to memory of 1852	2444	rundll32.exe	28
PID 2444 wrote to memory of 1852	2444	rundll32.exe	28
PID 2444 wrote to memory of 1852	2444	rundll32.exe	28
PID 2444 wrote to memory of 1852	2444	rundll32.exe	28
PID 2444 wrote to memory of 1852	2444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d0064b2169ddd4efeffeed9628b6490_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d0064b2169ddd4efeffeed9628b6490_NeikiAnalytics.dll,#1
  2⤵
  PID:1852