2e6a186fc512d8865e45e69e45816ba5312f7be500e36eef14e2efec9c51d650

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 02:23

Target

2e6a186fc512d8865e45e69e45816ba5312f7be500e36eef14e2efec9c51d650_NeikiAnalytics.dll
Size

529KB
MD5

5f35715e9bb7ff41874fd78d8771d810
SHA1

1f5ea89babcadff70f24315e7200272db3435b83
SHA256

2e6a186fc512d8865e45e69e45816ba5312f7be500e36eef14e2efec9c51d650
SHA512

3e14324caa27f31069824d5af59b32a976dcc888f7d40698394808e83ed4adb331993db012d0962732c109f7423428c84a487d59d455382bfd29d9179223c153
SSDEEP

12288:vxX+wKFLWjVSngYlNT/6vY/D3zMLNP6SHn:vQwO4/rQO6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2e6a186fc512d8865e45e69e45816ba5312f7be500e36eef14e2efec9c51d650_NeikiAnalytics.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2e6a186fc512d8865e45e69e45816ba5312f7be500e36eef14e2efec9c51d650_NeikiAnalytics.dll
  2⤵
  PID:2292