098b0003ab5b094bc76c1d92e474559210b41635addc704f824a868e07c65894

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 17:14

Target

098b0003ab5b094bc76c1d92e474559210b41635addc704f824a868e07c65894_NeikiAnalytics.dll
Size

177KB
MD5

e528327ea78b2d2c00331be4bafb7be0
SHA1

23ee6206e9258623b28a8f7b920844c45a326e95
SHA256

098b0003ab5b094bc76c1d92e474559210b41635addc704f824a868e07c65894
SHA512

3630f34f65a4c8ceed515cd049bd28895ad0f43f7fcc0070802efb7db460721a953a0abaf62694ec3836d4d6b6c5c6813fe7f3b396da251565361326172d92bc
SSDEEP

1536:J/jRjAFowsGyB3HwRjLczuGzZq5T0Czq:J5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\098b0003ab5b094bc76c1d92e474559210b41635addc704f824a868e07c65894_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\098b0003ab5b094bc76c1d92e474559210b41635addc704f824a868e07c65894_NeikiAnalytics.dll,#1
  2⤵
  PID:1540