998a67952a2335f02271fddaf0504c57e733c196cae3627a2c4b00ac555a2d17

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 13:13

Target

998a67952a2335f02271fddaf0504c57e733c196cae3627a2c4b00ac555a2d17_NeikiAnalytics.dll
Size

6KB
MD5

98378aee6ed349c37c01c2852a3f9900
SHA1

d6af38d34ea9cb42884a59a2ebad564e384d6b09
SHA256

998a67952a2335f02271fddaf0504c57e733c196cae3627a2c4b00ac555a2d17
SHA512

f2087fa0ed92d9ac4d06ff1c100354dc842fdcd0ddebfa3771eb6db27b0e2688d26330215bb274a0a1d186c57fd275cef9a418ad2e425a537d312e1fe622cd4e
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIagO30anhrjZ+lJpecvt6jJXWNXJpj9Z/Cfs:unSR6bgYSO30anhrjZRcvt6Sj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\998a67952a2335f02271fddaf0504c57e733c196cae3627a2c4b00ac555a2d17_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\998a67952a2335f02271fddaf0504c57e733c196cae3627a2c4b00ac555a2d17_NeikiAnalytics.dll,#1
  2⤵
  PID:2236