ceeeece9d03f83cb2b782e6eecaf1cbde7379a5bf1ca503beeb1dd1a9ae0d022

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 18:55

Target

2b47304fa659a7a6b8595c05b8923af0_NeikiAnalytics.dll
Size

81KB
MD5

2b47304fa659a7a6b8595c05b8923af0
SHA1

f3b59424b5f797a896bfd590d1f51842cc1f6fd7
SHA256

ceeeece9d03f83cb2b782e6eecaf1cbde7379a5bf1ca503beeb1dd1a9ae0d022
SHA512

ed2736c304bf644bc05763c1b0c85bae71c026374319ce7f6780011a180b9e7b99a1e984c40ba7a14e08b1000545841b0bcea4bbfe8452eba969a49c06b1c759
SSDEEP

1536:7tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WH:74v4JKXTx71w0ArSsXF3enq8WH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1876	2488	rundll32.exe	80
PID 2488 wrote to memory of 1876	2488	rundll32.exe	80
PID 2488 wrote to memory of 1876	2488	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b47304fa659a7a6b8595c05b8923af0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b47304fa659a7a6b8595c05b8923af0_NeikiAnalytics.dll,#1
  2⤵
  PID:1876