92e883636b015a80317c44efecfa980e581fbf5b30168b841110019b8d9b94ed

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 09:13

Target

92e883636b015a80317c44efecfa980e581fbf5b30168b841110019b8d9b94ed_NeikiAnalytics.dll
Size

2.4MB
MD5

8884ed8c067da11546d0ff4384cc80b0
SHA1

2d3316707ae1e558f57f2b1f8851c69670d9ab60
SHA256

92e883636b015a80317c44efecfa980e581fbf5b30168b841110019b8d9b94ed
SHA512

b90b81200be694ba8a59202c28c7dd46ecb312244746182fed6c908fc2e96d2cc14704b6c57e09b9786560248fc28648dddd506765b31ccc3d6c21648a9778b8
SSDEEP

49152:aqdaototkibsBsyhfY/BtI4U6MRu0awTtXQmIiSXYAPQqsvi4ut/yfi3E2G5JLsL:al1FsBsyJY5D10ET

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2884	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2884 wrote to memory of 2928	2884	rundll32.exe	29
PID 2884 wrote to memory of 2928	2884	rundll32.exe	29
PID 2884 wrote to memory of 2928	2884	rundll32.exe	29
PID 2884 wrote to memory of 2928	2884	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92e883636b015a80317c44efecfa980e581fbf5b30168b841110019b8d9b94ed_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92e883636b015a80317c44efecfa980e581fbf5b30168b841110019b8d9b94ed_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 224
    3⤵
    - Program crash
    PID:2928