b6190ca521fe7b6a21db5e89c76078eb617ef3500a6fb01b89f13f4a6d983a2e

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 22:09

Target

11a82432f2366f3a950765e033a50980_NeikiAnalytics.dll
Size

1.7MB
MD5

11a82432f2366f3a950765e033a50980
SHA1

86e6f27418ee56c4e8aed6e81b66d247745a2387
SHA256

b6190ca521fe7b6a21db5e89c76078eb617ef3500a6fb01b89f13f4a6d983a2e
SHA512

69e5e30bc9224581f711cf8b9e91fa3418a35ad3dcb1cba2059d517819e7221b9eafa0e63ec84e4d0147ca0ebd330ed6742237708365fa4acc9c636ba6d43298
SSDEEP

24576:buvA3wGPvVdpqPQfkTVPQh7uy6sWmQ1KyoC6nNobrEYQb+bbQXzHdXaL+:zwIVdKVPQh7sKnobriXzVa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3000	2656	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2656	1572	rundll32.exe	28
PID 1572 wrote to memory of 2656	1572	rundll32.exe	28
PID 1572 wrote to memory of 2656	1572	rundll32.exe	28
PID 1572 wrote to memory of 2656	1572	rundll32.exe	28
PID 1572 wrote to memory of 2656	1572	rundll32.exe	28
PID 1572 wrote to memory of 2656	1572	rundll32.exe	28
PID 1572 wrote to memory of 2656	1572	rundll32.exe	28
PID 2656 wrote to memory of 3000	2656	rundll32.exe	29
PID 2656 wrote to memory of 3000	2656	rundll32.exe	29
PID 2656 wrote to memory of 3000	2656	rundll32.exe	29
PID 2656 wrote to memory of 3000	2656	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11a82432f2366f3a950765e033a50980_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11a82432f2366f3a950765e033a50980_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 244
    3⤵
    - Program crash
    PID:3000

memory/2656-0-0x0000000002240000-0x0000000002569000-memory.dmp

Filesize
3.2MB

Download
memory/2656-1-0x0000000002240000-0x0000000002569000-memory.dmp

Filesize
3.2MB

Download