5296c530c9ea7c5bde8c5d6cd5af553b4fcedfad109e97a7df88ef7b9e9e5161

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 10:11

Target

5296c530c9ea7c5bde8c5d6cd5af553b4fcedfad109e97a7df88ef7b9e9e5161_NeikiAnalytics.dll
Size

940KB
MD5

11f4bbe2b4d305b58fe5f3293c1b0c90
SHA1

1b18ace69900f1a8474542f3a4d6604a6862102f
SHA256

5296c530c9ea7c5bde8c5d6cd5af553b4fcedfad109e97a7df88ef7b9e9e5161
SHA512

d59331f8b88e750984f57a6c37c24a95410ff88a19170ea11dda14749215de419ccdc6a983894fe9efc8d4c211ce95014f04d6e7bb9d47fbf2bbe47b6c0a9b0c
SSDEEP

6144:OaQk6Gd3TwWqHqlbKEHywYWI47dZTbH6uACar51+4UYpPcUNnnnnnnnnnnnnnnnL:OaQk6Gw1ubpar51+4UYp01j3U094

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2200	1652	rundll32.exe	28
PID 1652 wrote to memory of 2200	1652	rundll32.exe	28
PID 1652 wrote to memory of 2200	1652	rundll32.exe	28
PID 1652 wrote to memory of 2200	1652	rundll32.exe	28
PID 1652 wrote to memory of 2200	1652	rundll32.exe	28
PID 1652 wrote to memory of 2200	1652	rundll32.exe	28
PID 1652 wrote to memory of 2200	1652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5296c530c9ea7c5bde8c5d6cd5af553b4fcedfad109e97a7df88ef7b9e9e5161_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5296c530c9ea7c5bde8c5d6cd5af553b4fcedfad109e97a7df88ef7b9e9e5161_NeikiAnalytics.dll,#1
  2⤵
  PID:2200