56e006d18969aa2c1761039e1b481d3834a68823f83405f7906fbb6b075b03e1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 16:06

Target

1865526a478828dfa72d98f113fc6f90_NeikiAnalytics.dll
Size

76KB
MD5

1865526a478828dfa72d98f113fc6f90
SHA1

fd44a38d14c1f56bff0f3e5644bb52116f46169a
SHA256

56e006d18969aa2c1761039e1b481d3834a68823f83405f7906fbb6b075b03e1
SHA512

85a20a01a4641c33d1ae7d511f10036a78885a43496ef854f2a0f8d3d867f80fcc741f1f02c4d1c4d06dd82861f5a3614e468d0f496e20de2f45274675c08408
SSDEEP

1536:ZsOlik2QwLHHBWh/pVoEdpfXn6b8/CkobatFV/CcRzddu:OOGDbhWh/D6koiz/C2du

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 5016	4444	rundll32.exe	82
PID 4444 wrote to memory of 5016	4444	rundll32.exe	82
PID 4444 wrote to memory of 5016	4444	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1865526a478828dfa72d98f113fc6f90_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1865526a478828dfa72d98f113fc6f90_NeikiAnalytics.dll,#1
  2⤵
  PID:5016