21d4d81960990e40b63982326ac311d5183dbef23044afc7aee1e2e5e6cfbbb1

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 12:29

Target

8e385458ddf449c5394c6bf350f29e30_NeikiAnalytics.dll
Size

35KB
MD5

8e385458ddf449c5394c6bf350f29e30
SHA1

a9b1ca2044cb105027e5b7b81a4660c51037c70d
SHA256

21d4d81960990e40b63982326ac311d5183dbef23044afc7aee1e2e5e6cfbbb1
SHA512

247b7dbf65615ec8f17ac3f00c9e453019ff71726258047d32f736244fff1aa3257f72a93751fb933fba87050d2b160e632e0537d264c958df4a8d0f0ea15408
SSDEEP

768:dGODQqKU5UIZamSfW73IpNY52lpKU3SeagQ4v:dGaQqj5UIZamSfZp6523d+gQ4v

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1856	2268	rundll32.exe	28
PID 2268 wrote to memory of 1856	2268	rundll32.exe	28
PID 2268 wrote to memory of 1856	2268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e385458ddf449c5394c6bf350f29e30_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2268 -s 80
  2⤵
  PID:1856