c8b01aa1a996900ec93a7a3e03df8e7cdc67eedb68d7984d9c882ae9962a8400

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 01:43

Target

545a982750d200e572df360de312c1f0_NeikiAnalytics.dll
Size

192KB
MD5

545a982750d200e572df360de312c1f0
SHA1

69bad70076277575af70d5a0835a62c09bb244ff
SHA256

c8b01aa1a996900ec93a7a3e03df8e7cdc67eedb68d7984d9c882ae9962a8400
SHA512

6e7e59848e996882d2da84f92511350a70fb1d60402523954511daa92eb5b0363e742872915ca6b234d9c3db6966292640bbf9b9971d3c8df0f00222ba35d728
SSDEEP

3072:zYhhvWGlXvjIgdULxkAHw/ejMpgNeozfoj8FRvJlih/gDWgDKL:zYhTRekH/ejMGNewoh/gDWgDKL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	1952	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1952	1728	rundll32.exe	28
PID 1728 wrote to memory of 1952	1728	rundll32.exe	28
PID 1728 wrote to memory of 1952	1728	rundll32.exe	28
PID 1728 wrote to memory of 1952	1728	rundll32.exe	28
PID 1728 wrote to memory of 1952	1728	rundll32.exe	28
PID 1728 wrote to memory of 1952	1728	rundll32.exe	28
PID 1728 wrote to memory of 1952	1728	rundll32.exe	28
PID 1952 wrote to memory of 2516	1952	rundll32.exe	29
PID 1952 wrote to memory of 2516	1952	rundll32.exe	29
PID 1952 wrote to memory of 2516	1952	rundll32.exe	29
PID 1952 wrote to memory of 2516	1952	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\545a982750d200e572df360de312c1f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\545a982750d200e572df360de312c1f0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 220
    3⤵
    - Program crash
    PID:2516