99da2a7f8a3d7332bcaa54c712965439334dc3bde0b1a8c7600f21658333d4e1

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 18:10

Target

99da2a7f8a3d7332bcaa54c712965439334dc3bde0b1a8c7600f21658333d4e1_NeikiAnalytics.dll
Size

485KB
MD5

c2575fe25d5fe157d9f8991477bcd170
SHA1

709a56602edcc81716323f47e8f9e794ae9b440c
SHA256

99da2a7f8a3d7332bcaa54c712965439334dc3bde0b1a8c7600f21658333d4e1
SHA512

efc0004033330cafd5bd60c1a4eb291b3b9a6c5713355f6d7b289bb41c96e26bda3ca95739cdfd54111400553791edbe1aad03740b276150df8117c6485c509a
SSDEEP

6144:Ad48yHE+b43tWNMNo+G4CfsbCKEZuXMwiYni7opWeDfQFFsfMY+IRxwnQN:647/72fUzELnispWm4FmBFwQN

Score

8^/10

Blocklisted process makes network request 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99da2a7f8a3d7332bcaa54c712965439334dc3bde0b1a8c7600f21658333d4e1_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99da2a7f8a3d7332bcaa54c712965439334dc3bde0b1a8c7600f21658333d4e1_NeikiAnalytics.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1260