1a478ff4fb0dbefaa015558b52b5d0b873e3bec381905e75d9fdad6589edd034

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 02:32

Target

9b783f38dc5a3cf8043a450e292f3180_NeikiAnalytics.dll
Size

321KB
MD5

9b783f38dc5a3cf8043a450e292f3180
SHA1

20f72ee2ba0e5af1458433ed635b41cfb44f0fe7
SHA256

1a478ff4fb0dbefaa015558b52b5d0b873e3bec381905e75d9fdad6589edd034
SHA512

554abb86a8032cbe7da38c2c7ab4e92b03b914d6ee566a9350b2c34f4a40e445de58814639bca6669f3bfdcf712b1fcfde31ccc785cd58a79af895e6dbd4b30e
SSDEEP

1536:2fCxlve90F+nDdnPK4TN2fNj1dGf/f8t4nA4jkCekZBjQiWDbiNI9iGGmTjNS1Rw:2wInDNRT01JdAkAkCj2oSTjNoiN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1540	2016	regsvr32.exe	28
PID 2016 wrote to memory of 1540	2016	regsvr32.exe	28
PID 2016 wrote to memory of 1540	2016	regsvr32.exe	28
PID 2016 wrote to memory of 1540	2016	regsvr32.exe	28
PID 2016 wrote to memory of 1540	2016	regsvr32.exe	28
PID 2016 wrote to memory of 1540	2016	regsvr32.exe	28
PID 2016 wrote to memory of 1540	2016	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9b783f38dc5a3cf8043a450e292f3180_NeikiAnalytics.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9b783f38dc5a3cf8043a450e292f3180_NeikiAnalytics.dll
  2⤵
  PID:1540