46e67d4da9152ce3fc6c494e524a1ed33a31e3746df358308cd22d1b8af007d9

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 04:41

Target

7f9f2acc4461aa1ed487c8f99249b7a0_NeikiAnalytics.dll
Size

208KB
MD5

7f9f2acc4461aa1ed487c8f99249b7a0
SHA1

ce99b1471fe8a0ee54761d5e9c4522ac3c000ee2
SHA256

46e67d4da9152ce3fc6c494e524a1ed33a31e3746df358308cd22d1b8af007d9
SHA512

2de05fafbb8108c70f9b6eb614b2dabee4bc384bb7af2d63011ec46781d076cc416875b0562c943618cfd11ddc38e231f96fdf7c435368d559eb2137f2fa51ce
SSDEEP

3072:GgA90Z9u2rF7hngtehW4bUb5VwwkOIO8eMB+z53mLrDDAVOEneDpLx+ul1TUusqL:GZ6IKF14MUb5PhD5krDsEKedUuj7se

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3996	2980	rundll32.exe	82
PID 2980 wrote to memory of 3996	2980	rundll32.exe	82
PID 2980 wrote to memory of 3996	2980	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f9f2acc4461aa1ed487c8f99249b7a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f9f2acc4461aa1ed487c8f99249b7a0_NeikiAnalytics.dll,#1
  2⤵
  PID:3996

memory/3996-0-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download