25942b16036c9bb270a52ee0410fba06af15388728eeb15143717716c31ebc27

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 02:45

Target

9c441019d613b1d3199ce26038b92750_NeikiAnalytics.dll
Size

1.1MB
MD5

9c441019d613b1d3199ce26038b92750
SHA1

7e41b8950bdf6336085deb56eeb64c51cbac8b8b
SHA256

25942b16036c9bb270a52ee0410fba06af15388728eeb15143717716c31ebc27
SHA512

029e883d80998228927a68c3c30dc4201bbc18fae4733433e97c0dc655611dc960765eda8038d3634dab8a090d724a4ddab3cf7be4999ea5688c348ad45438f9
SSDEEP

24576:fKBml7NbKwFox/scViaEdBSNiozKBlBDHHTx/scVia6NiCOOOOO:fQi7F6Vi7dBSNTzQltHHT5ViJNxOOOOO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2056	2208	rundll32.exe	28
PID 2208 wrote to memory of 2056	2208	rundll32.exe	28
PID 2208 wrote to memory of 2056	2208	rundll32.exe	28
PID 2208 wrote to memory of 2056	2208	rundll32.exe	28
PID 2208 wrote to memory of 2056	2208	rundll32.exe	28
PID 2208 wrote to memory of 2056	2208	rundll32.exe	28
PID 2208 wrote to memory of 2056	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c441019d613b1d3199ce26038b92750_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c441019d613b1d3199ce26038b92750_NeikiAnalytics.dll,#1
  2⤵
  PID:2056