869c4dbeefeac0b8504d8809474f218936116a3c1451bec815b32c191a10fd57

Analysis

max time kernel
129s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 19:53

Target

5ebdcc32688e8e265b03a298c91d3940_NeikiAnalytics.dll
Size

47KB
MD5

5ebdcc32688e8e265b03a298c91d3940
SHA1

092a62b120bd2d015e8cc450b9d80d74e1434d1c
SHA256

869c4dbeefeac0b8504d8809474f218936116a3c1451bec815b32c191a10fd57
SHA512

85e11588a00b0f3733de4929fd30426d8246cf2d26919ada58faf65acdabd89e720fa94a0fcc43a4ba10c121b755609dfa34815913ac10ba96d096483ce3a8e6
SSDEEP

768:7/MKPffDs+TiCAwlQ0oGTaatgrk14LTMR071q/dAYAPP:7bfw+wwlQbatRR071q/dtAPP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4220	368	rundll32.exe	82
PID 368 wrote to memory of 4220	368	rundll32.exe	82
PID 368 wrote to memory of 4220	368	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ebdcc32688e8e265b03a298c91d3940_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ebdcc32688e8e265b03a298c91d3940_NeikiAnalytics.dll,#1
  2⤵
  PID:4220