47a038bc80b9ec81f01438a5bedb2a199e14acee6fbe1e2f375f2295c976dede

Analysis

max time kernel
141s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 12:38

Target

e2a16a58d9a53a19c6cb3cbd2c051d40_NeikiAnalytics.dll
Size

180KB
MD5

e2a16a58d9a53a19c6cb3cbd2c051d40
SHA1

95ca5967d5a0991fffc42bd26d8ddd1665de7990
SHA256

47a038bc80b9ec81f01438a5bedb2a199e14acee6fbe1e2f375f2295c976dede
SHA512

996fb9a147ddbcc1cd3dcc0924f8d84cdfe6487424f42d832dc44abcded5ffcfa1174ce316d7800d4af399838e1b512a1e59cdcda021811248b717a0d5a35bb0
SSDEEP

1536:hzCQbDRhzBUBXGHssW5PU1SldMgdo6cXB/ftj7CnfHR7yFRZK1jRiUbrkELP:N7+BqePU1SldL8hft+fx7yXZK1jrbYq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 236	1392	rundll32.exe	85
PID 1392 wrote to memory of 236	1392	rundll32.exe	85
PID 1392 wrote to memory of 236	1392	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2a16a58d9a53a19c6cb3cbd2c051d40_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2a16a58d9a53a19c6cb3cbd2c051d40_NeikiAnalytics.dll,#1
  2⤵
  PID:236