17433ac138f24ebc199381a6f763ae9f0bca211de05ef0a1cce88d5ae27af27b

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 20:31

Target

17433ac138f24ebc199381a6f763ae9f0bca211de05ef0a1cce88d5ae27af27b_NeikiAnalytics.dll
Size

257KB
MD5

155df6cbbf475b22b862be3cd92c29d0
SHA1

9cde16a7eeedbde191a8a3aa1a1cd93f72dd4f7a
SHA256

17433ac138f24ebc199381a6f763ae9f0bca211de05ef0a1cce88d5ae27af27b
SHA512

33ade8de8a92772420e1ae23a91c57f10d3cb41b045ab13044a524ddada85c9da87f1089ac7055a1e503bf45f6ab57ba169204fc58acd030df8576a22956efa7
SSDEEP

6144:JWwrJfmbqGBuLAkvMnlRyO7tk1SfPmQ49/:JdfmbqQuLAkv6l0IXPY/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 3012	2952	rundll32.exe	28
PID 2952 wrote to memory of 3012	2952	rundll32.exe	28
PID 2952 wrote to memory of 3012	2952	rundll32.exe	28
PID 2952 wrote to memory of 3012	2952	rundll32.exe	28
PID 2952 wrote to memory of 3012	2952	rundll32.exe	28
PID 2952 wrote to memory of 3012	2952	rundll32.exe	28
PID 2952 wrote to memory of 3012	2952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17433ac138f24ebc199381a6f763ae9f0bca211de05ef0a1cce88d5ae27af27b_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17433ac138f24ebc199381a6f763ae9f0bca211de05ef0a1cce88d5ae27af27b_NeikiAnalytics.dll,#1
  2⤵
  PID:3012