0993b25905efcca52ebeb4264192203d1e3c7ea236bcdd7b78abf94542b25868

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 22:55

Target

0993b25905efcca52ebeb4264192203d1e3c7ea236bcdd7b78abf94542b25868_NeikiAnalytics.dll
Size

132KB
MD5

34ce03be7d3bf93c3c78854f222625f0
SHA1

b96859016013e4e16362fd697df83c3ac972c033
SHA256

0993b25905efcca52ebeb4264192203d1e3c7ea236bcdd7b78abf94542b25868
SHA512

13d876cc8033d4eb562d0815104c3cfe16c6d08424c9cb8bc9605a1f5b5a61abd3d35d3013616a8830dab6acbc436d492fa6f45a49a07fc3bf68cd3a1db1a173
SSDEEP

1536:BduRtmXhL9GH1igtjsjnqO5gTGC8I7p5irPe+SZyDlroHj:BY/mXhxGHUgW7q8It5cPqZSlQj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0993b25905efcca52ebeb4264192203d1e3c7ea236bcdd7b78abf94542b25868_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0993b25905efcca52ebeb4264192203d1e3c7ea236bcdd7b78abf94542b25868_NeikiAnalytics.dll,#1
  2⤵
  PID:912