25d2e060a319301c3cc3aa0673d05aa1445db6ad2c3aae29a44a2f301bc4a2d5

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 19:26

Target

4891c571ef9cf79985db5e0d9b5f9400_NeikiAnalytics.dll
Size

6KB
MD5

4891c571ef9cf79985db5e0d9b5f9400
SHA1

a383618919b26dfc1f8a948d49434ab47f49108b
SHA256

25d2e060a319301c3cc3aa0673d05aa1445db6ad2c3aae29a44a2f301bc4a2d5
SHA512

f56a65067312fd09d050e7bd6595c1f3e98eb0f20cff770b58e59081956896324c258eb64cc402509107bc7699b27bd0616ec87ee76d3d2ce947786117c4a377
SSDEEP

96:hy859x0P8MaBqccnmuku03TccccHHSSzMma3HOqcJeBWsUcEpj0460LWy03cAM4a:F5oLsAmukueH3zMm04epy0zM4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1668	4976	rundll32.exe	82
PID 4976 wrote to memory of 1668	4976	rundll32.exe	82
PID 4976 wrote to memory of 1668	4976	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4891c571ef9cf79985db5e0d9b5f9400_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4891c571ef9cf79985db5e0d9b5f9400_NeikiAnalytics.dll,#1
  2⤵
  PID:1668