c300f21e129bd8a32fe18a4740adc18c419ada8a7f75706f86378eb8056530cd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 21:51

Target

23357859bb221f2c07cfb7f4898167c0_NeikiAnalytics.dll
Size

556KB
MD5

23357859bb221f2c07cfb7f4898167c0
SHA1

9e2a2481990ce8a5c169d265a6147280de439352
SHA256

c300f21e129bd8a32fe18a4740adc18c419ada8a7f75706f86378eb8056530cd
SHA512

41a2198c925689b18deac13cd60fb039350e0f3e59971700451a54bc62a28bba5c0c7b394eb52ad5aaaa2ff915ead07c3beaceec6d212529bfa4fd2845933131
SSDEEP

12288:yS66hAL+DxdOdvT/WlWxsNEG4NRWOPjaEX0Q73zLUqnM9:yq8+FdOdvT/WlWxsNEG4jUoDdnM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3032	4092	rundll32.exe	81
PID 4092 wrote to memory of 3032	4092	rundll32.exe	81
PID 4092 wrote to memory of 3032	4092	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23357859bb221f2c07cfb7f4898167c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23357859bb221f2c07cfb7f4898167c0_NeikiAnalytics.dll,#1
  2⤵
  PID:3032