5849dffeac144ff5855c3b31b44e56ac9b40f22882dc1f9c2b8bdb8bf17de299

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 10:45

Target

5849dffeac144ff5855c3b31b44e56ac9b40f22882dc1f9c2b8bdb8bf17de299_NeikiAnalytics.dll
Size

6KB
MD5

98113d8ed1ae371bd91a57dcf53376f0
SHA1

3853557fe6d31cb91e805e9c09df8517ae7ba583
SHA256

5849dffeac144ff5855c3b31b44e56ac9b40f22882dc1f9c2b8bdb8bf17de299
SHA512

e04aa54e5a375b782bf7acbb451c407357b64f84fd12a100f01cbe3be6e26d8d19e6342c62f7b3215cedfbf806c14027bdbcc3acc9337bf1ec4cab2e5a84e435
SSDEEP

96:PIV9yIjhsZrg0j6I/AhWNiOesSjKWSoB6JjHGI5R6tD6bux:PyIIjWXGhq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5849dffeac144ff5855c3b31b44e56ac9b40f22882dc1f9c2b8bdb8bf17de299_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5849dffeac144ff5855c3b31b44e56ac9b40f22882dc1f9c2b8bdb8bf17de299_NeikiAnalytics.dll,#1
  2⤵
  PID:2344