0b14b0c782e4717bdb68e20ab18170f850d534b725bd1b51649a9c1d6019e72a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 21:25

Target

0b14b0c782e4717bdb68e20ab18170f850d534b725bd1b51649a9c1d6019e72a_NeikiAnalytics.dll
Size

7KB
MD5

865f9d0f19193050cfded564f7448ce0
SHA1

139d824575078cb519e654539e289e6fbeed078e
SHA256

0b14b0c782e4717bdb68e20ab18170f850d534b725bd1b51649a9c1d6019e72a
SHA512

131f04b074928f369c6ccbe8a1114a09a30fcc5c86fef3ded271acc89ddc7e57b2752f57f2114cd4917f6cee06906c39f67301b3106a11bbec5cc264eb6c99e3
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWSbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPQq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b14b0c782e4717bdb68e20ab18170f850d534b725bd1b51649a9c1d6019e72a_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b14b0c782e4717bdb68e20ab18170f850d534b725bd1b51649a9c1d6019e72a_NeikiAnalytics.dll,#1
  2⤵
  PID:2080