9a497393a5dfc71d1fa263edeec658c45f10a177a6ed763d69345616d947a87e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 09:53

Target

9a497393a5dfc71d1fa263edeec658c45f10a177a6ed763d69345616d947a87e_NeikiAnalytics.dll
Size

6KB
MD5

225bf91eb8e69119e51e373e8ee54870
SHA1

c7bdf47698d730d1bfa46c8c8e224800ef7f3080
SHA256

9a497393a5dfc71d1fa263edeec658c45f10a177a6ed763d69345616d947a87e
SHA512

3db4e114d9063921252aa43d29ebfe36654965ef189764e4418eb7181cc93a93a13f89bac976a21c93c73c89c93fa9c42ed99f8944b6424c06ef4ab9be4c18a8
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0nB+BDq9J5SH:VDa9VUX9bQWHB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a497393a5dfc71d1fa263edeec658c45f10a177a6ed763d69345616d947a87e_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a497393a5dfc71d1fa263edeec658c45f10a177a6ed763d69345616d947a87e_NeikiAnalytics.dll,#1
  2⤵
  PID:2168