5c8bb31d911cf0311e8923d84d5395bb0cc431ba13d72acd05fa1ebc8377249b

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:40

Target

5c8bb31d911cf0311e8923d84d5395bb0cc431ba13d72acd05fa1ebc8377249b_NeikiAnalytics.dll
Size

6KB
MD5

9ae519a4c3a65655a513ca43cc088440
SHA1

cb9aae5a6954abddc79425d8f6da02e2b04b5bbf
SHA256

5c8bb31d911cf0311e8923d84d5395bb0cc431ba13d72acd05fa1ebc8377249b
SHA512

cdb551d7bd0a16ffeb00fe96b954e06ab7568aa63285f869241a0b3e6575460004fe6bc225357246a8d02e11502d13af4cf8371402db1bd90754674989f6e655
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU10zB+BDq9J5SV3DY:CSVVEPozmB7RB+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1748	1968	rundll32.exe	28
PID 1968 wrote to memory of 1748	1968	rundll32.exe	28
PID 1968 wrote to memory of 1748	1968	rundll32.exe	28
PID 1968 wrote to memory of 1748	1968	rundll32.exe	28
PID 1968 wrote to memory of 1748	1968	rundll32.exe	28
PID 1968 wrote to memory of 1748	1968	rundll32.exe	28
PID 1968 wrote to memory of 1748	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c8bb31d911cf0311e8923d84d5395bb0cc431ba13d72acd05fa1ebc8377249b_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c8bb31d911cf0311e8923d84d5395bb0cc431ba13d72acd05fa1ebc8377249b_NeikiAnalytics.dll,#1
  2⤵
  PID:1748