ab032db8e141a732a198937c9f0a74f3d967b1caa1035e1c22ce895238ab4a41

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 12:15

Target

ab032db8e141a732a198937c9f0a74f3d967b1caa1035e1c22ce895238ab4a41_NeikiAnalytics.dll
Size

304KB
MD5

e0723a282f3caed0bf59f94d106a6b10
SHA1

3789b6dc8da7ab88d2bfb50a9d93b7d840456943
SHA256

ab032db8e141a732a198937c9f0a74f3d967b1caa1035e1c22ce895238ab4a41
SHA512

f8ce2641dffab607b5fb527ba08e22be3e2bec061a639ad3dbeecc7e24a8044088864db470c08732410843416b549f3b0d6d747f44c805c7d7758e470ad3fce1
SSDEEP

96:cBcNkn8wyL3ulySdT4nO/W8vpUjDRYjDR0+8NJ5ErRHHX:l+2q/BjWa6jVYjVpMJ5El3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	2316	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2316	1620	rundll32.exe	28
PID 1620 wrote to memory of 2316	1620	rundll32.exe	28
PID 1620 wrote to memory of 2316	1620	rundll32.exe	28
PID 1620 wrote to memory of 2316	1620	rundll32.exe	28
PID 1620 wrote to memory of 2316	1620	rundll32.exe	28
PID 1620 wrote to memory of 2316	1620	rundll32.exe	28
PID 1620 wrote to memory of 2316	1620	rundll32.exe	28
PID 2316 wrote to memory of 2188	2316	rundll32.exe	29
PID 2316 wrote to memory of 2188	2316	rundll32.exe	29
PID 2316 wrote to memory of 2188	2316	rundll32.exe	29
PID 2316 wrote to memory of 2188	2316	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab032db8e141a732a198937c9f0a74f3d967b1caa1035e1c22ce895238ab4a41_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab032db8e141a732a198937c9f0a74f3d967b1caa1035e1c22ce895238ab4a41_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 248
    3⤵
    - Program crash
    PID:2188