769aa6abfc3ff09131565906ad07c6a67604869ae9766662859c610b6d96ede1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 03:35

Target

769aa6abfc3ff09131565906ad07c6a67604869ae9766662859c610b6d96ede1_NeikiAnalytics.dll
Size

7KB
MD5

8f9f3aa2c92fd049ffb84a7c93c27b20
SHA1

3291b14270bb88137f3445a6d65024ab435e2600
SHA256

769aa6abfc3ff09131565906ad07c6a67604869ae9766662859c610b6d96ede1
SHA512

19724603eeddcaaa7a791e914019d42b5ebffba4e702aa06194b715f89b8251e8d433d830e76ca5d1d8caca9fb9a9eb1fb5de8751495c5a4752409ff6f5e9e61
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPZd3cX5aXW:wUaJf/aFbP0OK2JaX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2964	2868	rundll32.exe	28
PID 2868 wrote to memory of 2964	2868	rundll32.exe	28
PID 2868 wrote to memory of 2964	2868	rundll32.exe	28
PID 2868 wrote to memory of 2964	2868	rundll32.exe	28
PID 2868 wrote to memory of 2964	2868	rundll32.exe	28
PID 2868 wrote to memory of 2964	2868	rundll32.exe	28
PID 2868 wrote to memory of 2964	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\769aa6abfc3ff09131565906ad07c6a67604869ae9766662859c610b6d96ede1_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\769aa6abfc3ff09131565906ad07c6a67604869ae9766662859c610b6d96ede1_NeikiAnalytics.dll,#1
  2⤵
  PID:2964