4c9723e0bbe86b55443326992028fe6a85f7e7fa5aff5ef5384ef3a25f6310a0

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 10:57

Target

4c9723e0bbe86b55443326992028fe6a85f7e7fa5aff5ef5384ef3a25f6310a0_NeikiAnalytics.dll
Size

6KB
MD5

213f42584b20754649aca5cbcf408720
SHA1

ce8934e7b15eee84a25878ed2e98a0cc41766574
SHA256

4c9723e0bbe86b55443326992028fe6a85f7e7fa5aff5ef5384ef3a25f6310a0
SHA512

7b6ad5516dd2470f15b308799a888b47b7468512158c6d76669bfc94c1d3febe7d64d81eecd1971ad09e7d66de838fd5a9a28c1d07bf2c13f54bb591c509d353
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqpNl+3CM4G2W0DW000tHdsD+YE+AvRGjBWf:hy859x0P8MaPKrDwe29+2AAFAiT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1916	2164	rundll32.exe	28
PID 2164 wrote to memory of 1916	2164	rundll32.exe	28
PID 2164 wrote to memory of 1916	2164	rundll32.exe	28
PID 2164 wrote to memory of 1916	2164	rundll32.exe	28
PID 2164 wrote to memory of 1916	2164	rundll32.exe	28
PID 2164 wrote to memory of 1916	2164	rundll32.exe	28
PID 2164 wrote to memory of 1916	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c9723e0bbe86b55443326992028fe6a85f7e7fa5aff5ef5384ef3a25f6310a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c9723e0bbe86b55443326992028fe6a85f7e7fa5aff5ef5384ef3a25f6310a0_NeikiAnalytics.dll,#1
  2⤵
  PID:1916