08ebf929dad20f64c84bf713a8821897faaaf58a6d6e5e7f5a2de491eb368b23

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 20:22

Target

08ebf929dad20f64c84bf713a8821897faaaf58a6d6e5e7f5a2de491eb368b23_NeikiAnalytics.dll
Size

4.4MB
MD5

3fcd0394c2d7cd902a025ba3c44ccb80
SHA1

ace8b19e7d8fa102cd540423cd0ede7271b08ad7
SHA256

08ebf929dad20f64c84bf713a8821897faaaf58a6d6e5e7f5a2de491eb368b23
SHA512

1695cc1ea380a47d90067775ce50a7a3aa93b0c0a9ecacbb8394abdb7437f36bdc0d6c1a204b74d3f1f7b419605852e41148c47995b701a2177546705a95982e
SSDEEP

49152:+Ko8EP4vJkrIVK4sIU3HAeLvM5U0QxnoCfTkaPKHUjoRL5C2RElmCs2260aQ:+9P4vJkrIVKDIU3HAeLE53WnuvUMfCu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	2212	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2212	1916	rundll32.exe	28
PID 1916 wrote to memory of 2212	1916	rundll32.exe	28
PID 1916 wrote to memory of 2212	1916	rundll32.exe	28
PID 1916 wrote to memory of 2212	1916	rundll32.exe	28
PID 1916 wrote to memory of 2212	1916	rundll32.exe	28
PID 1916 wrote to memory of 2212	1916	rundll32.exe	28
PID 1916 wrote to memory of 2212	1916	rundll32.exe	28
PID 2212 wrote to memory of 2200	2212	rundll32.exe	29
PID 2212 wrote to memory of 2200	2212	rundll32.exe	29
PID 2212 wrote to memory of 2200	2212	rundll32.exe	29
PID 2212 wrote to memory of 2200	2212	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08ebf929dad20f64c84bf713a8821897faaaf58a6d6e5e7f5a2de491eb368b23_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08ebf929dad20f64c84bf713a8821897faaaf58a6d6e5e7f5a2de491eb368b23_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 256
    3⤵
    - Program crash
    PID:2200