28709122efe35f9e9d07c8fe56686147fea9a707ed211c3017a3e14bce8c1c71

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 01:12

Target

28709122efe35f9e9d07c8fe56686147fea9a707ed211c3017a3e14bce8c1c71_NeikiAnalytics.dll
Size

274KB
MD5

68802fe397c2098e2adc863b30c43d00
SHA1

489900a7788a0d59db77657be62babf241c5cf3a
SHA256

28709122efe35f9e9d07c8fe56686147fea9a707ed211c3017a3e14bce8c1c71
SHA512

9947a5a5cf9dcf0a2158164d0f79d72947f1c63db44ebb1e516111908959fffc95e66ae4c25825c4d7f8f4a4955e783392faa7f7dd71acb05d56a5613150cc37
SSDEEP

6144:sl73UrE42px4TYEyDXTZELp1WPzTBNazKpzTBNUW:KrUrE42pVDtELpG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28709122efe35f9e9d07c8fe56686147fea9a707ed211c3017a3e14bce8c1c71_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28709122efe35f9e9d07c8fe56686147fea9a707ed211c3017a3e14bce8c1c71_NeikiAnalytics.dll,#1
  2⤵
  PID:1460