9fee08afd07b337905130aad7f6cfba3dbbdf8d8976c663b0b768a5d2805fc98

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 07:10

Target

9b2464728fd4d12a0a5cf695b78d8600_NeikiAnalytics.dll
Size

7KB
MD5

9b2464728fd4d12a0a5cf695b78d8600
SHA1

7db1484931319c1bd15626cdbe4d18736bb87193
SHA256

9fee08afd07b337905130aad7f6cfba3dbbdf8d8976c663b0b768a5d2805fc98
SHA512

fa0cfb8111270522efeb40e468600ee10d0e2c348129d31876d222819a496da551eec8cc8a4e6712bbc44b9b38f8b14ba3ea1a64125482572bf9515c20828514
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIWeM7Z0rdbbaDEDrZXfBXGDk:unSR6bgYz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 2976	4468	rundll32.exe	82
PID 4468 wrote to memory of 2976	4468	rundll32.exe	82
PID 4468 wrote to memory of 2976	4468	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b2464728fd4d12a0a5cf695b78d8600_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b2464728fd4d12a0a5cf695b78d8600_NeikiAnalytics.dll,#1
  2⤵
  PID:2976