7007b5f4992a3bb2ca89cc7d8834309e9da515d2245f35f07592a7d7567cea81

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 12:08

Target

7007b5f4992a3bb2ca89cc7d8834309e9da515d2245f35f07592a7d7567cea81_NeikiAnalytics.dll
Size

6KB
MD5

e6fb15e4e41a6dce07dff00e74238cb0
SHA1

51fd7dae6025bc2bb26df92145ef3b1f601b1f69
SHA256

7007b5f4992a3bb2ca89cc7d8834309e9da515d2245f35f07592a7d7567cea81
SHA512

2b4babdc2e0053313d11f44a51d44f444f74a0a769b9f775b306e06dc95a3ca4451f0667c8ab2962dcecbc88be31cc571106a3d3483e3d38009d3262a0456e71
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU10KB+BDq9J5SV3DY:CSVVEPozmB74B+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2172	2116	rundll32.exe	28
PID 2116 wrote to memory of 2172	2116	rundll32.exe	28
PID 2116 wrote to memory of 2172	2116	rundll32.exe	28
PID 2116 wrote to memory of 2172	2116	rundll32.exe	28
PID 2116 wrote to memory of 2172	2116	rundll32.exe	28
PID 2116 wrote to memory of 2172	2116	rundll32.exe	28
PID 2116 wrote to memory of 2172	2116	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7007b5f4992a3bb2ca89cc7d8834309e9da515d2245f35f07592a7d7567cea81_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7007b5f4992a3bb2ca89cc7d8834309e9da515d2245f35f07592a7d7567cea81_NeikiAnalytics.dll,#1
  2⤵
  PID:2172