0c1fbf89968bfb104c29b1622e8a8f78a7e3bc935f1eb092fbeb9c88e2897a78

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 20:46

Target

0c1fbf89968bfb104c29b1622e8a8f78a7e3bc935f1eb092fbeb9c88e2897a78_NeikiAnalytics.dll
Size

6KB
MD5

89480c5583cd40e104fcf83ec48e8130
SHA1

d5c62eeadfe82b3cd7ec336096f06acb8e6e824a
SHA256

0c1fbf89968bfb104c29b1622e8a8f78a7e3bc935f1eb092fbeb9c88e2897a78
SHA512

a161ebd826e6ab84d5a07a74196a1e2cdb4cec2d60bbac8f8f2e90989258c0bc53abd87cef04d86632064b566ca7ef1f555ee0321d32214a6458846fd21e39b2
SSDEEP

96:nEY2RrF1eqwi4g3bF5ePuxHoDi36vEj0Q0006SbEOG:EHRh1eppaa8M+0Q0006So

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 2172	396	rundll32.exe	28
PID 396 wrote to memory of 2172	396	rundll32.exe	28
PID 396 wrote to memory of 2172	396	rundll32.exe	28
PID 396 wrote to memory of 2172	396	rundll32.exe	28
PID 396 wrote to memory of 2172	396	rundll32.exe	28
PID 396 wrote to memory of 2172	396	rundll32.exe	28
PID 396 wrote to memory of 2172	396	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c1fbf89968bfb104c29b1622e8a8f78a7e3bc935f1eb092fbeb9c88e2897a78_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c1fbf89968bfb104c29b1622e8a8f78a7e3bc935f1eb092fbeb9c88e2897a78_NeikiAnalytics.dll,#1
  2⤵
  PID:2172