25c69ca66d2831f0957742e2ca3a759e2d8aa736e21df012620ab8aa8b42c48c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 23:37

Target

25c69ca66d2831f0957742e2ca3a759e2d8aa736e21df012620ab8aa8b42c48c_NeikiAnalytics.dll
Size

208KB
MD5

cb3e8140e4d72625637830fb0a205ab0
SHA1

43342102f5de6f9f4c2ec8d0c5b3e88e8e4f8d6a
SHA256

25c69ca66d2831f0957742e2ca3a759e2d8aa736e21df012620ab8aa8b42c48c
SHA512

8e859890eaa40857df031000628717b3fd4f73c2bfc7d5e93f172cf5a5439793c391412e105de4f43c386c19b75b3e96b6909814d0e14bc6cd7510158f92816e
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUfY5gF:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2816 2772 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2816	2772	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2008 wrote to memory of 2772	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2772	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2772	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2772	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2772	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2772	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2772	2008	rundll32.exe	rundll32.exe
PID 2772 wrote to memory of 2816	2772	rundll32.exe	WerFault.exe
PID 2772 wrote to memory of 2816	2772	rundll32.exe	WerFault.exe
PID 2772 wrote to memory of 2816	2772	rundll32.exe	WerFault.exe
PID 2772 wrote to memory of 2816	2772	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c69ca66d2831f0957742e2ca3a759e2d8aa736e21df012620ab8aa8b42c48c_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c69ca66d2831f0957742e2ca3a759e2d8aa736e21df012620ab8aa8b42c48c_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 228
3⤵
- Program crash
PID:2816