350b8c1a61812a0f7d9666faaa8c00c237eaca9a4d0ec350186d0056acf35f6a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 05:32

Target

350b8c1a61812a0f7d9666faaa8c00c237eaca9a4d0ec350186d0056acf35f6a_NeikiAnalytics.dll
Size

2.3MB
MD5

77a4e931c58d8312b44421745e0df8f0
SHA1

fe47727e54df224702c6ed3d37ecd201535ab319
SHA256

350b8c1a61812a0f7d9666faaa8c00c237eaca9a4d0ec350186d0056acf35f6a
SHA512

6dff432fd10c10e08b4f48cf9782765d1f204772726e70f3ae9ad9bc6356d826d7a0da9bf5ec07a43981fe9e82b6b3964412f67b91cfe3d4350c9941865cdba7
SSDEEP

49152:sNpeDnlUYX1g3nynmOKLBCqk9WhRhdbhLqo6GEXON8N:sDexX1OnynmBdCMqt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\350b8c1a61812a0f7d9666faaa8c00c237eaca9a4d0ec350186d0056acf35f6a_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\350b8c1a61812a0f7d9666faaa8c00c237eaca9a4d0ec350186d0056acf35f6a_NeikiAnalytics.dll,#1
  2⤵
  PID:1888