332144b7df7dd2f00058c296c0d4bcb8482ad217fb08124e5d3ca6f59e66b931

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:20

Target

332144b7df7dd2f00058c296c0d4bcb8482ad217fb08124e5d3ca6f59e66b931_NeikiAnalytics.dll
Size

2.6MB
MD5

99d12b72080a4951cf9e67f659c42f70
SHA1

9d960242984204033dd654872369df4123b73643
SHA256

332144b7df7dd2f00058c296c0d4bcb8482ad217fb08124e5d3ca6f59e66b931
SHA512

8c0d6d32cdef6712efb099819c35bc69053fd24d685ff5edfabbe02ec09894c3d311a294d88315dee55b716a9e11beb0500e5f28efffb619ae48482733d37cf3
SSDEEP

49152:jebcOvE6EzQ1g3xa0b3YrZzPXxWCsvJgOQg4oGI2unSu6uZfaBcVzK/dqQh8Rp:jeZiYzF+zKWRp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1524	1316	rundll32.exe	28
PID 1316 wrote to memory of 1524	1316	rundll32.exe	28
PID 1316 wrote to memory of 1524	1316	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\332144b7df7dd2f00058c296c0d4bcb8482ad217fb08124e5d3ca6f59e66b931_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1316 -s 80
  2⤵
  PID:1524