6aeb4265c43aae5820030754dc79447c28a4d44ebb873a029ed1a76742c6615c

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 14:23

Target

6aeb4265c43aae5820030754dc79447c28a4d44ebb873a029ed1a76742c6615c_NeikiAnalytics.dll
Size

6KB
MD5

c90563fdfa32c0fd553f5a7242b89dd0
SHA1

98e5065d467e616a6d6b3ca3bfbaabc94803f33f
SHA256

6aeb4265c43aae5820030754dc79447c28a4d44ebb873a029ed1a76742c6615c
SHA512

9e1a40ee2d30a2b42f8be3152ed8b8ac65c79c4baf0e4d199ff6e97a181ba5e12285b18efab90561f2a94eb4acafb18b1b9ce110cd424595653dcab32e2d84c2
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0nB+BDq9J5SC:8qtV0HAr4WB+FqX5SC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aeb4265c43aae5820030754dc79447c28a4d44ebb873a029ed1a76742c6615c_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aeb4265c43aae5820030754dc79447c28a4d44ebb873a029ed1a76742c6615c_NeikiAnalytics.dll,#1
  2⤵
  PID:2036