224f919a3bd9d19e8cf820d019e5fbd4752ddc65197e15d575136f63d24f6052

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 23:18

Target

224f919a3bd9d19e8cf820d019e5fbd4752ddc65197e15d575136f63d24f6052_NeikiAnalytics.dll
Size

5.8MB
MD5

45ff48bacffe1cb34cb47493581c6780
SHA1

e13f37c5e0907300a0d054adda4c63e2f95cc113
SHA256

224f919a3bd9d19e8cf820d019e5fbd4752ddc65197e15d575136f63d24f6052
SHA512

e8e1d102b598625527247045f81133202943cf27150916d5280315a8eb97e504407d523f2af2c6b2a87ebbe366b41bf6189d9c0fbe0383eb4d6d95316444c934
SSDEEP

98304:V4ETVJ6FmGH5SdtXKgb5lcivdP1WA3BNoZqRpxQ:VrK8G4Lt5lcivdrNoZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2600	2788	rundll32.exe	28
PID 2788 wrote to memory of 2600	2788	rundll32.exe	28
PID 2788 wrote to memory of 2600	2788	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\224f919a3bd9d19e8cf820d019e5fbd4752ddc65197e15d575136f63d24f6052_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2788 -s 236
  2⤵
  PID:2600