4838f8bb6e36cdebc893ec95e38f5365e38f7a8d9e7ec9f6dde5ad148e0fac04

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 20:03

Target

00757e74ead55043588efbbfe86fbcd0_NeikiAnalytics.dll
Size

2.0MB
MD5

00757e74ead55043588efbbfe86fbcd0
SHA1

f7e676046c3e8a426f1a3f716ccc6a8971e24822
SHA256

4838f8bb6e36cdebc893ec95e38f5365e38f7a8d9e7ec9f6dde5ad148e0fac04
SHA512

7a3487414d8ba12f349e3b35341f67f0a4a56d0f220247086c72760afcd45b7a80c1364d4765c99e9a50f4551d0d32c2453f6d230f2d8ba66e977e7de289bbdb
SSDEEP

49152:SpX9JVeE9Hv/Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akh:a3P9HXZpy9KyhMI50Du8LljslNsyHiqZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	2376	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2376	2104	rundll32.exe	28
PID 2104 wrote to memory of 2376	2104	rundll32.exe	28
PID 2104 wrote to memory of 2376	2104	rundll32.exe	28
PID 2104 wrote to memory of 2376	2104	rundll32.exe	28
PID 2104 wrote to memory of 2376	2104	rundll32.exe	28
PID 2104 wrote to memory of 2376	2104	rundll32.exe	28
PID 2104 wrote to memory of 2376	2104	rundll32.exe	28
PID 2376 wrote to memory of 1580	2376	rundll32.exe	29
PID 2376 wrote to memory of 1580	2376	rundll32.exe	29
PID 2376 wrote to memory of 1580	2376	rundll32.exe	29
PID 2376 wrote to memory of 1580	2376	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00757e74ead55043588efbbfe86fbcd0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00757e74ead55043588efbbfe86fbcd0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 220
    3⤵
    - Program crash
    PID:1580