841a5607397c55190ea876df0f5e964bf925be4f0bd589e6421c7695c2cf3ce7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 10:45

Target

b9349d32f21c747e1fe87202fa8fdc30_NeikiAnalytics.dll
Size

5KB
MD5

b9349d32f21c747e1fe87202fa8fdc30
SHA1

81456ef3e8f85ed2375649a87fc5d7e6f1c763b8
SHA256

841a5607397c55190ea876df0f5e964bf925be4f0bd589e6421c7695c2cf3ce7
SHA512

d30cecc6df46cfbc0ccea0ae4443c44c130ca2c8888d2540dae6af7dfb3f3030c1a993901afd327e4aa8886402cacfde8e94efd70c71c6ac764267b3ac9d5019
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIeo4xBCldLLGh0iLPzilDDx:unSR6bgYY4CnY/Dz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9349d32f21c747e1fe87202fa8fdc30_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9349d32f21c747e1fe87202fa8fdc30_NeikiAnalytics.dll,#1
  2⤵
  PID:1236