3cd99ba381be2ae54bbdf4d82b501464750cf482bd74e2551ad11b41407250c7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 06:40

Target

3cd99ba381be2ae54bbdf4d82b501464750cf482bd74e2551ad11b41407250c7_NeikiAnalytics.dll
Size

53KB
MD5

89b02e828556119b43e23161ccf51100
SHA1

82c89f4899d70fa3074180db86a4436751613e0b
SHA256

3cd99ba381be2ae54bbdf4d82b501464750cf482bd74e2551ad11b41407250c7
SHA512

b277a7cb1d0da89c652b953cf8eb192fdbf8c645a461ebe95916b1c496f1ccd33977763e2395d0534a60c03ae53a033cfa357fbe96a79d79567dfea5105728cd
SSDEEP

1536:/lnE32hmLJrWbpYf0/A6i2eF5KFdhldwTl:NnlhirWbqf046i2eF5K3hrwTl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2632	2108	rundll32.exe	28
PID 2108 wrote to memory of 2632	2108	rundll32.exe	28
PID 2108 wrote to memory of 2632	2108	rundll32.exe	28
PID 2108 wrote to memory of 2632	2108	rundll32.exe	28
PID 2108 wrote to memory of 2632	2108	rundll32.exe	28
PID 2108 wrote to memory of 2632	2108	rundll32.exe	28
PID 2108 wrote to memory of 2632	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cd99ba381be2ae54bbdf4d82b501464750cf482bd74e2551ad11b41407250c7_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cd99ba381be2ae54bbdf4d82b501464750cf482bd74e2551ad11b41407250c7_NeikiAnalytics.dll,#1
  2⤵
  PID:2632