d1bb123d04d8b4682fb7c0ff8446ad62bba74875025718c97d8df88a92429025

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 23:08

Target

2661786aaf13be215c3010ecee9ad180_NeikiAnalytics.dll
Size

869KB
MD5

2661786aaf13be215c3010ecee9ad180
SHA1

78d793f163ac5326c9ac54a09640ac7c48242942
SHA256

d1bb123d04d8b4682fb7c0ff8446ad62bba74875025718c97d8df88a92429025
SHA512

35e92578c96e5ab39f7f20ed04e7ae592e3eaa596095df74793862ad8e43a9c421600952c13cb7ce2d9f56f4a6ce26465e4d5f0d5500eb05c681683577b87285
SSDEEP

24576:OGMKNExePNaWgltFhLIRrrwQIfir9q7jW/5WiQMzU2+:xIXDQkJfWq7jcWiRB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1056	2316	rundll32.exe	82
PID 2316 wrote to memory of 1056	2316	rundll32.exe	82
PID 2316 wrote to memory of 1056	2316	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2661786aaf13be215c3010ecee9ad180_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2661786aaf13be215c3010ecee9ad180_NeikiAnalytics.dll,#1
  2⤵
  PID:1056

memory/1056-0-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/1056-1-0x0000000000BE0000-0x0000000000BE3000-memory.dmp

Filesize
12KB

Download
memory/1056-2-0x0000000000BE0000-0x0000000000BE3000-memory.dmp

Filesize
12KB

Download