0f4d8fc846bbcc3291fa28909316dd7cb1d2b6c3728a2d7618cf011ab7b93bb5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 20:14

Target

0f4d8fc846bbcc3291fa28909316dd7cb1d2b6c3728a2d7618cf011ab7b93bb5_NeikiAnalytics.dll
Size

4.3MB
MD5

2748134b75e4423b20dfb7a04e17ea00
SHA1

f722b9fc1db847ae0eff0bd89feb632c15e2b5ac
SHA256

0f4d8fc846bbcc3291fa28909316dd7cb1d2b6c3728a2d7618cf011ab7b93bb5
SHA512

77390d080a71eb8289a3f6dc435bb3dc8a90c148e261ca586734343ef099d0fc45c40860f39b7e7d039021d12256705779beaaf66b62bea087a74a5f50dc2303
SSDEEP

98304:jFOym2EnKyuWDpUL8z35Ae+b1CPwDvt3uFADC:jFOv2EnK/2pUL8j5Abb1CPwDvt3uFADC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1928	1712	rundll32.exe	28
PID 1712 wrote to memory of 1928	1712	rundll32.exe	28
PID 1712 wrote to memory of 1928	1712	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f4d8fc846bbcc3291fa28909316dd7cb1d2b6c3728a2d7618cf011ab7b93bb5_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1712 -s 104
  2⤵
  PID:1928