af8b7a7383eab0d598e442228cf7d1c3c52bb1ac04829c0cf139d6d1a2c2c58e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 14:35

Target

af8b7a7383eab0d598e442228cf7d1c3c52bb1ac04829c0cf139d6d1a2c2c58e_NeikiAnalytics.dll
Size

193KB
MD5

248a270cb823592f606526b69f9cb7f0
SHA1

1cd425e845e6672b6a3b6c198f183f338755b2fa
SHA256

af8b7a7383eab0d598e442228cf7d1c3c52bb1ac04829c0cf139d6d1a2c2c58e
SHA512

32a4fb61523d97bf87218028ff3b63250ecc926d7312fdc62ab81fd46e8103b6ba4d44316692721cd5519ee04d2ec4c14a56db1c2a75c57e6589628d2c7b95d7
SSDEEP

3072:2K/cqnATtcoEa7y4uhiL0t1WlBAY2pQty+DuB2:2KUqnnUnXL0t1gQatO2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	2456	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2456	1688	rundll32.exe	28
PID 1688 wrote to memory of 2456	1688	rundll32.exe	28
PID 1688 wrote to memory of 2456	1688	rundll32.exe	28
PID 1688 wrote to memory of 2456	1688	rundll32.exe	28
PID 1688 wrote to memory of 2456	1688	rundll32.exe	28
PID 1688 wrote to memory of 2456	1688	rundll32.exe	28
PID 1688 wrote to memory of 2456	1688	rundll32.exe	28
PID 2456 wrote to memory of 1944	2456	rundll32.exe	29
PID 2456 wrote to memory of 1944	2456	rundll32.exe	29
PID 2456 wrote to memory of 1944	2456	rundll32.exe	29
PID 2456 wrote to memory of 1944	2456	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af8b7a7383eab0d598e442228cf7d1c3c52bb1ac04829c0cf139d6d1a2c2c58e_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af8b7a7383eab0d598e442228cf7d1c3c52bb1ac04829c0cf139d6d1a2c2c58e_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 224
    3⤵
    - Program crash
    PID:1944