68a6519708f0e7a00ff4b837fe655a98c908184d7f2dbf0baed61cdc364b31f6

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 05:08

Target

68a6519708f0e7a00ff4b837fe655a98c908184d7f2dbf0baed61cdc364b31f6_NeikiAnalytics.dll
Size

6KB
MD5

d02f592201298b901885a197316cd380
SHA1

0883efe4f2fbaf73908c7547cf2ffce868cee848
SHA256

68a6519708f0e7a00ff4b837fe655a98c908184d7f2dbf0baed61cdc364b31f6
SHA512

b066dfd02dbb188d8de996791bf76031f14407a7d6e39ab0e0ca8b8bbef55d3218f5c1ac230dc7c71cd242f5b088d82f61ea210f1c1dc40009a67646a7ce840e
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIGeOX0AiA1/nyJ9Vr+qGH:unSR6bgYteWLPyJzr+qc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2112	1748	rundll32.exe	28
PID 1748 wrote to memory of 2112	1748	rundll32.exe	28
PID 1748 wrote to memory of 2112	1748	rundll32.exe	28
PID 1748 wrote to memory of 2112	1748	rundll32.exe	28
PID 1748 wrote to memory of 2112	1748	rundll32.exe	28
PID 1748 wrote to memory of 2112	1748	rundll32.exe	28
PID 1748 wrote to memory of 2112	1748	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68a6519708f0e7a00ff4b837fe655a98c908184d7f2dbf0baed61cdc364b31f6_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68a6519708f0e7a00ff4b837fe655a98c908184d7f2dbf0baed61cdc364b31f6_NeikiAnalytics.dll,#1
  2⤵
  PID:2112