88c7b73bf3b5f5a0e22004e242f05cce7811c6c288acc7064f168f289df9e746

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 06:02

Target

88c7b73bf3b5f5a0e22004e242f05cce7811c6c288acc7064f168f289df9e746_NeikiAnalytics.dll
Size

12KB
MD5

e649d5a8ab21a09e7f3d3357cfc8b490
SHA1

c59da1925e9a65ae72061a4bc22eed1101bdb046
SHA256

88c7b73bf3b5f5a0e22004e242f05cce7811c6c288acc7064f168f289df9e746
SHA512

8f654afc32db0266033146acdb7c48c548359234a7c10ba587295651926ead97d67be8a145fc54d686bb90ed272f07140acc3314e2e381b5c4df5824fe1bbefb
SSDEEP

48:SJmZi49emG12hmIJhHBl6u8oYPW0VHYJHtin9bmC0nAm0vtvNpnZ:gmd9emGkJh2fPvSQ9bmrnh6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1684	1600	rundll32.exe	28
PID 1600 wrote to memory of 1684	1600	rundll32.exe	28
PID 1600 wrote to memory of 1684	1600	rundll32.exe	28
PID 1600 wrote to memory of 1684	1600	rundll32.exe	28
PID 1600 wrote to memory of 1684	1600	rundll32.exe	28
PID 1600 wrote to memory of 1684	1600	rundll32.exe	28
PID 1600 wrote to memory of 1684	1600	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88c7b73bf3b5f5a0e22004e242f05cce7811c6c288acc7064f168f289df9e746_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88c7b73bf3b5f5a0e22004e242f05cce7811c6c288acc7064f168f289df9e746_NeikiAnalytics.dll,#1
  2⤵
  PID:1684

memory/1684-1-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/1684-0-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download