012cf942421db41177946fff6a5869cb0438265aa693d31334c770003ab2f818

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 19:54

Target

012cf942421db41177946fff6a5869cb0438265aa693d31334c770003ab2f818_NeikiAnalytics.dll
Size

10KB
MD5

7b73e26bd2a66a92fcad1a34e39128e0
SHA1

ac957ab269a395b8920616579dcf8290f76093f7
SHA256

012cf942421db41177946fff6a5869cb0438265aa693d31334c770003ab2f818
SHA512

9fd4f2614a8ac7519096bff06d9b4ea72ad9d05cf03d4393b67bbb79d50f9c365e27d822f3a5c3365bc762a624f0ca09cf7474d286c01d9532d4e516a17c0b2e
SSDEEP

192:VHkAfH6fGLag5WDKD3XLPVlD6wOjv66YLs:iLiAW77PVlejv6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28
PID 2228 wrote to memory of 1820	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\012cf942421db41177946fff6a5869cb0438265aa693d31334c770003ab2f818_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\012cf942421db41177946fff6a5869cb0438265aa693d31334c770003ab2f818_NeikiAnalytics.dll,#1
  2⤵
  PID:1820