51eb5d1c5063d18f87674e137e9c0c04d59e67a7627f63928e9176b44049395c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 10:07

Target

51eb5d1c5063d18f87674e137e9c0c04d59e67a7627f63928e9176b44049395c_NeikiAnalytics.dll
Size

501KB
MD5

42b75554414ae98a2f22acf9411914d0
SHA1

8c8a8a2bfef31879392a68865896de11a091f9aa
SHA256

51eb5d1c5063d18f87674e137e9c0c04d59e67a7627f63928e9176b44049395c
SHA512

2504dae7a4223e1a720a4eb117961f680c950d05ef47f1a70885b29075069b1caed1aed3b2ede8fbb0f7f2204d43aae25eda3475df27e10f9d3606daf4d53158
SSDEEP

12288:NfbbgPK5ku2hYxBfh0EsUDwbJGTZbIemufLiI3cdRw5B0Q9I6S4yR/b7G:NbAKVhfcI5B0EmNR/2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1620	1936	rundll32.exe	28
PID 1936 wrote to memory of 1620	1936	rundll32.exe	28
PID 1936 wrote to memory of 1620	1936	rundll32.exe	28
PID 1936 wrote to memory of 1620	1936	rundll32.exe	28
PID 1936 wrote to memory of 1620	1936	rundll32.exe	28
PID 1936 wrote to memory of 1620	1936	rundll32.exe	28
PID 1936 wrote to memory of 1620	1936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51eb5d1c5063d18f87674e137e9c0c04d59e67a7627f63928e9176b44049395c_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51eb5d1c5063d18f87674e137e9c0c04d59e67a7627f63928e9176b44049395c_NeikiAnalytics.dll,#1
  2⤵
  PID:1620