0cd782d5895fe09199d3faabe8967e8da74666398bd87a9248549d7c0177c74e

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 23:26

Target

0cd782d5895fe09199d3faabe8967e8da74666398bd87a9248549d7c0177c74e_NeikiAnalytics.dll
Size

6KB
MD5

4203c0a31baff35f150447b210f79640
SHA1

dd9a652c33c8b148ede76983790bf12b93e95b4b
SHA256

0cd782d5895fe09199d3faabe8967e8da74666398bd87a9248549d7c0177c74e
SHA512

c3545b9135698197518631e8646c9560d3a1ba042a7761a861573b4d1bf0d3647825404f1a0079d3c2391bad7c9f25dbb048e003bc34f11dcf5fca610c853e25
SSDEEP

96:nEY2RrF1eqwi4m/fBKp6Lx9L0HTslOmtHAuO4yDYLPSM:EHRh1eppO0pO9L4YjOHbM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2352	3000	rundll32.exe	28
PID 3000 wrote to memory of 2352	3000	rundll32.exe	28
PID 3000 wrote to memory of 2352	3000	rundll32.exe	28
PID 3000 wrote to memory of 2352	3000	rundll32.exe	28
PID 3000 wrote to memory of 2352	3000	rundll32.exe	28
PID 3000 wrote to memory of 2352	3000	rundll32.exe	28
PID 3000 wrote to memory of 2352	3000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cd782d5895fe09199d3faabe8967e8da74666398bd87a9248549d7c0177c74e_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cd782d5895fe09199d3faabe8967e8da74666398bd87a9248549d7c0177c74e_NeikiAnalytics.dll,#1
  2⤵
  PID:2352