2bc1ca62ed010b522402e4b2963cba366f34da3dc5026d3cdcd1f229bb4eefe4

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 10:40

Target

b8f0624a5059fb71e022973b809c6e30_NeikiAnalytics.dll
Size

1.9MB
MD5

b8f0624a5059fb71e022973b809c6e30
SHA1

1539b10548c40590c15cc25bf029a02d492664ed
SHA256

2bc1ca62ed010b522402e4b2963cba366f34da3dc5026d3cdcd1f229bb4eefe4
SHA512

4ac4ee4c74f8d691a29deff5b525f58bc026cfe9ad44188339578da81b2cbf7e6a6fc32aa9193c68f721d519027a99a700789ff25be654cb727d4fa3037e8ed2
SSDEEP

49152:+N60NVmbEUVpGS30lQHPB7haMowhB7/Taft2zh6IA:UVmbrPCMowh5/TaftsPA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1928	1748	rundll32.exe	28
PID 1748 wrote to memory of 1928	1748	rundll32.exe	28
PID 1748 wrote to memory of 1928	1748	rundll32.exe	28
PID 1748 wrote to memory of 1928	1748	rundll32.exe	28
PID 1748 wrote to memory of 1928	1748	rundll32.exe	28
PID 1748 wrote to memory of 1928	1748	rundll32.exe	28
PID 1748 wrote to memory of 1928	1748	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8f0624a5059fb71e022973b809c6e30_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8f0624a5059fb71e022973b809c6e30_NeikiAnalytics.dll,#1
  2⤵
  PID:1928

memory/1928-0-0x0000000010000000-0x00000000101E3000-memory.dmp

Filesize
1.9MB

Download
memory/1928-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1928-3-0x0000000002980000-0x0000000002A9F000-memory.dmp

Filesize
1.1MB

Download
memory/1928-4-0x00000000020B0000-0x00000000021B3000-memory.dmp

Filesize
1.0MB

Download
memory/1928-5-0x00000000020B0000-0x00000000021B3000-memory.dmp

Filesize
1.0MB

Download
memory/1928-7-0x00000000020B0000-0x00000000021B3000-memory.dmp

Filesize
1.0MB

Download
memory/1928-8-0x0000000010000000-0x00000000101E3000-memory.dmp

Filesize
1.9MB

Download
memory/1928-15-0x00000000020B0000-0x00000000021B3000-memory.dmp

Filesize
1.0MB

Download
memory/1928-16-0x0000000002AA0000-0x00000000035DB000-memory.dmp

Filesize
11.2MB

Download
memory/1928-17-0x00000000035E0000-0x00000000036D5000-memory.dmp

Filesize
980KB

Download
memory/1928-20-0x00000000036E0000-0x00000000037D7000-memory.dmp

Filesize
988KB

Download
memory/1928-19-0x00000000036E0000-0x00000000037D7000-memory.dmp

Filesize
988KB

Download
memory/1928-22-0x00000000036E0000-0x00000000037D7000-memory.dmp

Filesize
988KB

Download
memory/1928-23-0x0000000000050000-0x0000000000057000-memory.dmp

Filesize
28KB

Download
memory/1928-25-0x00000000639F0000-0x0000000063A1A000-memory.dmp

Filesize
168KB

Download