6aef5341367f5e4e0848e2816698b8b30fa2190cd6cd52d23c9886fec0a4a561

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 08:16

Target

6aef5341367f5e4e0848e2816698b8b30fa2190cd6cd52d23c9886fec0a4a561_NeikiAnalytics.dll
Size

6KB
MD5

fe9a11da3493e1603526b110e1556b30
SHA1

563a62630cef62c46c086cede6ceca7f9cc343da
SHA256

6aef5341367f5e4e0848e2816698b8b30fa2190cd6cd52d23c9886fec0a4a561
SHA512

e97549a4c181fc9fa25d502238e80ea9da00c9118370b4e6ef65c78dca5c93fb5ca020cff01e1856e6c3db433bf9c61777ccfa24f736d52f88cb2f69f0a9263e
SSDEEP

96:hy859x0P8MaNldupGScB5+209iEst/1GZw5qjSYhI5PXoC55RA:F5oLYEBdAcT45A

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 3016	920	rundll32.exe	28
PID 920 wrote to memory of 3016	920	rundll32.exe	28
PID 920 wrote to memory of 3016	920	rundll32.exe	28
PID 920 wrote to memory of 3016	920	rundll32.exe	28
PID 920 wrote to memory of 3016	920	rundll32.exe	28
PID 920 wrote to memory of 3016	920	rundll32.exe	28
PID 920 wrote to memory of 3016	920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aef5341367f5e4e0848e2816698b8b30fa2190cd6cd52d23c9886fec0a4a561_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aef5341367f5e4e0848e2816698b8b30fa2190cd6cd52d23c9886fec0a4a561_NeikiAnalytics.dll,#1
  2⤵
  PID:3016