045d8660d38ff8c62f6213b269db3cca62b6ffac47533467a090af40f80ffded

Analysis

max time kernel
98s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 16:52

Target

1d885ad428dc65f2cb2a7acf4ba8fc50_NeikiAnalytics.dll
Size

547KB
MD5

1d885ad428dc65f2cb2a7acf4ba8fc50
SHA1

f5502ead24dbd437b623345b507b4430c7359cdc
SHA256

045d8660d38ff8c62f6213b269db3cca62b6ffac47533467a090af40f80ffded
SHA512

b9ccee2112285f06cf771cba04f29b9fb8a0e821242630e5049ec35abd14245c34b5ab4c3dcb8c499e41814451a51b21d9651c5672699e9a85407225e4e0ab26
SSDEEP

12288:sWyXoZEfNZ9+HfTdyLCJ8frr8Bua0YJP8:eoZEfNZ9+HfTeIrbt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3524	1164	rundll32.exe	82
PID 1164 wrote to memory of 3524	1164	rundll32.exe	82
PID 1164 wrote to memory of 3524	1164	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d885ad428dc65f2cb2a7acf4ba8fc50_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d885ad428dc65f2cb2a7acf4ba8fc50_NeikiAnalytics.dll,#1
  2⤵
  PID:3524