1c79c786e96ff42b8cfcfd53aecddcf247df2377abf77e7da098ca0522e34402

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 21:46

Target

1c79c786e96ff42b8cfcfd53aecddcf247df2377abf77e7da098ca0522e34402_NeikiAnalytics.dll
Size

101KB
MD5

5db0cf2af8ba9aaf4ac5680d240a0470
SHA1

38c33616d903ffc9513b66ef0834c0fce66c40cd
SHA256

1c79c786e96ff42b8cfcfd53aecddcf247df2377abf77e7da098ca0522e34402
SHA512

6ac0e864f7a926f21e09dd30fb3d7d637a8a4aa90259a83cc3801f6ba6beab980cc6458f81cdbe5612e24426fa35a6a7819fdc945d97423325acc0c2614e306c
SSDEEP

1536:tFqLEZ5+ZgmI9yBk1DeJS2gey9m3Da1XvuIKLfePlrMW0gayRjSET3xBniZAZtzm:K7gmIT8JhDyrXvBNgW0DqjSEVBnL/zh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	2288	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2288 wrote to memory of 2300	2288	rundll32.exe	29
PID 2288 wrote to memory of 2300	2288	rundll32.exe	29
PID 2288 wrote to memory of 2300	2288	rundll32.exe	29
PID 2288 wrote to memory of 2300	2288	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c79c786e96ff42b8cfcfd53aecddcf247df2377abf77e7da098ca0522e34402_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c79c786e96ff42b8cfcfd53aecddcf247df2377abf77e7da098ca0522e34402_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 236
    3⤵
    - Program crash
    PID:2300

memory/2288-0-0x0000000000130000-0x000000000014E000-memory.dmp

Filesize
120KB

Download
memory/2288-1-0x0000000000130000-0x000000000014E000-memory.dmp

Filesize
120KB

Download