ac9b300f0a42a21f9a17a8b36743ffd42f81a5e70fec18252a1ac1549013bc16

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 13:04

Target

ac9b300f0a42a21f9a17a8b36743ffd42f81a5e70fec18252a1ac1549013bc16_NeikiAnalytics.dll
Size

6KB
MD5

98325993aa417e6b53508dabfdaaa910
SHA1

34d3741e83c6d49657981673ea00cadfe1b0264a
SHA256

ac9b300f0a42a21f9a17a8b36743ffd42f81a5e70fec18252a1ac1549013bc16
SHA512

16605735e18eba18d63e9db800dadf1d2ac23ab52a21933095fe166ed5b5a7b9f0bdfd4cec0669970bf6fcdb6640ecf441d734edee4c4bfc7126b9625bb0560c
SSDEEP

96:nEY2RrF1eqwi4X0+uSZlZPJo/hsw3upuXkV1sp6LLTIgASs:EHRh1eppX0+uSZlZPgx3Qb/oKLT59s

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2416	2652	rundll32.exe	28
PID 2652 wrote to memory of 2416	2652	rundll32.exe	28
PID 2652 wrote to memory of 2416	2652	rundll32.exe	28
PID 2652 wrote to memory of 2416	2652	rundll32.exe	28
PID 2652 wrote to memory of 2416	2652	rundll32.exe	28
PID 2652 wrote to memory of 2416	2652	rundll32.exe	28
PID 2652 wrote to memory of 2416	2652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac9b300f0a42a21f9a17a8b36743ffd42f81a5e70fec18252a1ac1549013bc16_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac9b300f0a42a21f9a17a8b36743ffd42f81a5e70fec18252a1ac1549013bc16_NeikiAnalytics.dll,#1
  2⤵
  PID:2416