14f8098af1d4945a1cbe3bf9b31bdfa4d38d64df11431e7ea20e99bedb08cdbd

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 20:04

Target

14f8098af1d4945a1cbe3bf9b31bdfa4d38d64df11431e7ea20e99bedb08cdbd_NeikiAnalytics.dll
Size

7.3MB
MD5

326c44b72ac8e1c06ec6861224975810
SHA1

814acbd496bde116f0c958c3f5a59e5a744a2ed8
SHA256

14f8098af1d4945a1cbe3bf9b31bdfa4d38d64df11431e7ea20e99bedb08cdbd
SHA512

3acbb7eab0784282681bd3c9bbdcb1b170ef5c7268c03944dd57e269d0bb82854297beef1dd2f0de6031dacef44dc5caa6d1586970e3ca55109ff3a202c03ae2
SSDEEP

98304:pM+4LvLUKPljsT0ModfHa1kZPOQt3Jxa2g1lgw1bpweKQoXIAAyP/U:u+GvLUK20eiPNtza2gvg6bpwIsA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	2012	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2012	2056	rundll32.exe	28
PID 2056 wrote to memory of 2012	2056	rundll32.exe	28
PID 2056 wrote to memory of 2012	2056	rundll32.exe	28
PID 2056 wrote to memory of 2012	2056	rundll32.exe	28
PID 2056 wrote to memory of 2012	2056	rundll32.exe	28
PID 2056 wrote to memory of 2012	2056	rundll32.exe	28
PID 2056 wrote to memory of 2012	2056	rundll32.exe	28
PID 2012 wrote to memory of 1968	2012	rundll32.exe	29
PID 2012 wrote to memory of 1968	2012	rundll32.exe	29
PID 2012 wrote to memory of 1968	2012	rundll32.exe	29
PID 2012 wrote to memory of 1968	2012	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14f8098af1d4945a1cbe3bf9b31bdfa4d38d64df11431e7ea20e99bedb08cdbd_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14f8098af1d4945a1cbe3bf9b31bdfa4d38d64df11431e7ea20e99bedb08cdbd_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 260
    3⤵
    - Program crash
    PID:1968