442b2d5b678adf8c24f40d49b5d90258c2193caa5cedc854b4f3812d2035de08

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 20:02

Target

e4d2a773dfbe336d1b4af716ceb4cd40_NeikiAnalytics.dll
Size

148KB
MD5

e4d2a773dfbe336d1b4af716ceb4cd40
SHA1

7a7116c56ca89d445522b9c7070db1005d326e8d
SHA256

442b2d5b678adf8c24f40d49b5d90258c2193caa5cedc854b4f3812d2035de08
SHA512

f6af33496d7fdbb3184dac9f2fedd31a46cf01083e4e39f37a162b5f7a077c0136b217beea8aba67533ba196aca52efd79c06a6cffce7d7c6f67ed75083c8adc
SSDEEP

3072:q2PZ9+cYYefornDRunRtezjaISUqfKm8ydCE8bRknIQwwj3f8TX34kNOHbvhkzmu:q2PZ9+cYYefornDRunRtezjaISUqCm8p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	1020	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1020	536	rundll32.exe	85
PID 536 wrote to memory of 1020	536	rundll32.exe	85
PID 536 wrote to memory of 1020	536	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4d2a773dfbe336d1b4af716ceb4cd40_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4d2a773dfbe336d1b4af716ceb4cd40_NeikiAnalytics.dll,#1
  2⤵
  PID:1020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 600
    3⤵
    - Program crash
    PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1020 -ip 1020
1⤵
PID:3912