0dc6e90ad44493a38ebd149fb94a6c46b4979238f14e3e279d67b7ec11c0b765

Analysis

max time kernel
136s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 00:13

Target

2987bb711165f62831e9da5ffcfed9b0_NeikiAnalytics.dll
Size

168KB
MD5

2987bb711165f62831e9da5ffcfed9b0
SHA1

8208ed08ce62238cda6e8db582c6b99e03168ace
SHA256

0dc6e90ad44493a38ebd149fb94a6c46b4979238f14e3e279d67b7ec11c0b765
SHA512

34792c2dfc027e09c487f3ad0a8ae77476032b80664acc226e92496f35ada5dde40cb2889094d7ca9d29b6fa734461b977a20660fbf43c805f7a93c06c58fcf3
SSDEEP

96:+iNpTnJtsZLpdcDYbo7NkIf7YcPHLsWagfUZWlAOed8R2PRfw+wzlvGk:dHTn85TCXpPHF9cZWl9CS2Szl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1800	3500	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 3500	3968	rundll32.exe	82
PID 3968 wrote to memory of 3500	3968	rundll32.exe	82
PID 3968 wrote to memory of 3500	3968	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2987bb711165f62831e9da5ffcfed9b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2987bb711165f62831e9da5ffcfed9b0_NeikiAnalytics.dll,#1
  2⤵
  PID:3500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 544
    3⤵
    - Program crash
    PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3500 -ip 3500
1⤵
PID:4712