62bde539cb5adaaff69d972c18c298fc06ae4431d1a28648509b4b7c398a4616

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 12:34

Target

62bde539cb5adaaff69d972c18c298fc06ae4431d1a28648509b4b7c398a4616_NeikiAnalytics.dll
Size

135KB
MD5

3b63c544db8bccd7a0aa72dc858ce470
SHA1

d104219d4960edf24a98945515ae250e788a15a6
SHA256

62bde539cb5adaaff69d972c18c298fc06ae4431d1a28648509b4b7c398a4616
SHA512

8c0871f01432b31e164ffcf4dd141cee2ee8f1aa712dc8218d553009c6f20a8f131dfee9d66625b2ef2fbc3d7440cf9424084f46f9b8193290de844f7700807b
SSDEEP

3072:lIdf9o9jeLeMB1Owr10xWLJ7tSMgYGhM55c:lIdf9OjlWLRzgYRbc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bde539cb5adaaff69d972c18c298fc06ae4431d1a28648509b4b7c398a4616_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bde539cb5adaaff69d972c18c298fc06ae4431d1a28648509b4b7c398a4616_NeikiAnalytics.dll,#1
  2⤵
  PID:2848