99f5f50bd82bcd52741195852bc2abacdaa444e7499a6d1bce01a5caaa04bb71

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 13:25

Target

99f5f50bd82bcd52741195852bc2abacdaa444e7499a6d1bce01a5caaa04bb71_NeikiAnalytics.dll
Size

27KB
MD5

2bc5ff52b3e6a6a35300a2b44756f470
SHA1

bf6b79e8361e90d7a4eb210098cd94dd0fb80bf7
SHA256

99f5f50bd82bcd52741195852bc2abacdaa444e7499a6d1bce01a5caaa04bb71
SHA512

694782e57f4ca0ee7e87691a0b83de9ec9837a2d1a2b77331fa1ee259de4c5fb1447e9147b2d266ef0e811d4387920e03707692d541414965c56f71e95847d27
SSDEEP

192:M7L99n9tKizdSyrFUP+OM43sqU77vPWYjOzNlrI0zaIM6:M7LJzdS1+asBX3jMNlr/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2368	1948	rundll32.exe	28
PID 1948 wrote to memory of 2368	1948	rundll32.exe	28
PID 1948 wrote to memory of 2368	1948	rundll32.exe	28
PID 1948 wrote to memory of 2368	1948	rundll32.exe	28
PID 1948 wrote to memory of 2368	1948	rundll32.exe	28
PID 1948 wrote to memory of 2368	1948	rundll32.exe	28
PID 1948 wrote to memory of 2368	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99f5f50bd82bcd52741195852bc2abacdaa444e7499a6d1bce01a5caaa04bb71_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99f5f50bd82bcd52741195852bc2abacdaa444e7499a6d1bce01a5caaa04bb71_NeikiAnalytics.dll,#1
  2⤵
  PID:2368