45d25669d0c78caaec085b88deae9d52ebc5e248fec22661539b138e4677b18e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 20:51

Target

003c500b4e8ed60dd9a5d0638a569f50_NeikiAnalytics.dll
Size

644KB
MD5

003c500b4e8ed60dd9a5d0638a569f50
SHA1

0c13337e0c89f0c2f5c9ccc1c5dd9ef4bbc83dee
SHA256

45d25669d0c78caaec085b88deae9d52ebc5e248fec22661539b138e4677b18e
SHA512

37831c5eb3adcde9fadcd8735087714cbeb6485f9e7fc7b1c2b84a3cc407f1f5dfdc04dc30dd6fb8d16b7f37be83c01f24e9516d8e6e95e03f98f5c604ab7ae8
SSDEEP

12288:HX9GMGp70zQll4agH80/ugud7o51/TQdCDEhDG1dYbHk7tSm1jKqID2IEnIFqPT8:HUsHvudTqPTtVLvCpMkLFv9TPSi6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 4296	652	rundll32.exe	81
PID 652 wrote to memory of 4296	652	rundll32.exe	81
PID 652 wrote to memory of 4296	652	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\003c500b4e8ed60dd9a5d0638a569f50_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\003c500b4e8ed60dd9a5d0638a569f50_NeikiAnalytics.dll,#1
  2⤵
  PID:4296