a73b338d41c1de3a93a3a2b6af5ede77917e31783f0724d571ad1f6d364d32b9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 11:24

Target

33126d7db53096d49f4e2718dbc39d40_NeikiAnalytics.dll
Size

128KB
MD5

33126d7db53096d49f4e2718dbc39d40
SHA1

c01660baa11c7a2d971d069cb3e3975a80d8c4b4
SHA256

a73b338d41c1de3a93a3a2b6af5ede77917e31783f0724d571ad1f6d364d32b9
SHA512

7f4eb45c8f00e046ff7dfd703ca6c733dab2ee2819ebb82d7940778d918bff0710574c7b2a5674b89c4a17f56ba8ff6137a5f5c834319885bd4899c29a96b932
SSDEEP

3072:LWtAsLxolgxawS6J7M1tRloCXJf/YBA/ds0Zh82JE:QS6J7M1Tx/OA/+0A2y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33126d7db53096d49f4e2718dbc39d40_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33126d7db53096d49f4e2718dbc39d40_NeikiAnalytics.dll,#1
  2⤵
  PID:2224