c9258b53cb9062f8681e5ee413c003113357c00574a6662363a9714e3a1dc268

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 20:54

Target

5a45086c4d4eaed43c95330577892bc0_NeikiAnalytics.dll
Size

6KB
MD5

5a45086c4d4eaed43c95330577892bc0
SHA1

b2b04967058374dce0b8943921d837b3c48460a8
SHA256

c9258b53cb9062f8681e5ee413c003113357c00574a6662363a9714e3a1dc268
SHA512

93fd421b448511bc813968379ca970c66e7ead88c229991034ede4ffb601990ade579461e713ad48ae41e062de31ee5879285e0c6cf46a67a876c4f5d6c659f1
SSDEEP

192:JKZbXmGbONI05GGXG5p6YGSYAXjyevZBGeGBGGiL:JKZbXmGyNI05GGXGb6YGSYATyevZBGe/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4888	5016	rundll32.exe	80
PID 5016 wrote to memory of 4888	5016	rundll32.exe	80
PID 5016 wrote to memory of 4888	5016	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a45086c4d4eaed43c95330577892bc0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a45086c4d4eaed43c95330577892bc0_NeikiAnalytics.dll,#1
  2⤵
  PID:4888