8e6a8f09057ae33d44fc0cf943c9225801898c22b7893908e03df4f737cbb30a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 08:20

Target

8e6a8f09057ae33d44fc0cf943c9225801898c22b7893908e03df4f737cbb30a_NeikiAnalytics.dll
Size

156KB
MD5

8f83894d2d9807ea6000e01cc3551a40
SHA1

b7f419dd5eff0edbd0b333909f408fc969db6626
SHA256

8e6a8f09057ae33d44fc0cf943c9225801898c22b7893908e03df4f737cbb30a
SHA512

8687cafb2739614897eb8841a1fcabedc5a98b2bd97ed1402a9e12409add7124a589cbad1d42ae7de9da269088b23505b2c38d01375ea32d023f3fb47495c6b5
SSDEEP

3072:Lafy3i4MhT0a2tFRjhFnslzKgZD2jUY8c9zG/cMDBcIJHVKBW+TBfE9M/ClV:fpsF2jr8cZvITKc+TB8M

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e6a8f09057ae33d44fc0cf943c9225801898c22b7893908e03df4f737cbb30a_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e6a8f09057ae33d44fc0cf943c9225801898c22b7893908e03df4f737cbb30a_NeikiAnalytics.dll,#1
  2⤵
  PID:2012