acba73db5c42c692a1c93b002d2455c24607b0c952716975bf30746ca09c77bd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 13:07

Target

acba73db5c42c692a1c93b002d2455c24607b0c952716975bf30746ca09c77bd_NeikiAnalytics.dll
Size

331KB
MD5

998f7e2f8b145f5200cd417e98923e90
SHA1

5123bc41c3e79229d563d351522398180a96854f
SHA256

acba73db5c42c692a1c93b002d2455c24607b0c952716975bf30746ca09c77bd
SHA512

f3c883a83f918e7a45d9039a411f083f987abcc4a9194412e68d5f65533aac51b307156d169be8019752a1c3d2a011f3dc6632ff859613adc443635b1c0e09b5
SSDEEP

6144:gepnKlhOTa4VxgOEupCigyM/NXhwFgdy+7dV39BfanT+6vQNarKm4p3uCsQgSThZ:LghOnb9DgD1X+/+Jt9BfanT+6vQNarKZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2236	1928	rundll32.exe	28
PID 1928 wrote to memory of 2236	1928	rundll32.exe	28
PID 1928 wrote to memory of 2236	1928	rundll32.exe	28
PID 1928 wrote to memory of 2236	1928	rundll32.exe	28
PID 1928 wrote to memory of 2236	1928	rundll32.exe	28
PID 1928 wrote to memory of 2236	1928	rundll32.exe	28
PID 1928 wrote to memory of 2236	1928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acba73db5c42c692a1c93b002d2455c24607b0c952716975bf30746ca09c77bd_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\acba73db5c42c692a1c93b002d2455c24607b0c952716975bf30746ca09c77bd_NeikiAnalytics.dll,#1
  2⤵
  PID:2236