81932b4d803ac470cf47070f58822f1f118aec2b8fc1d37724d4755aa4f41967

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 21:29

Target

0c6f153b495ea84097bcae3be7722b90_NeikiAnalytics.dll
Size

64KB
MD5

0c6f153b495ea84097bcae3be7722b90
SHA1

32d6c4fbd82e4261712b26399704b44010b2ac83
SHA256

81932b4d803ac470cf47070f58822f1f118aec2b8fc1d37724d4755aa4f41967
SHA512

9744bc867591803514258da8c2a57cc6d4117d6cabce697ead9475b43a28a5eb9cc056086cefeb7344561cc0cc55d094737313e93318965a0496dce425d44021
SSDEEP

1536:2qHbH82Zj0v+xycVFUd9LNmCXkg2L7Sc:2q7ccYvYXV2d9LNmFZfS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c6f153b495ea84097bcae3be7722b90_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c6f153b495ea84097bcae3be7722b90_NeikiAnalytics.dll,#1
  2⤵
  PID:2012