19e86cc6f6b391c5781214119974859cd06f37a84d566e3b5ab278bc80a31bcf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 03:28

Target

91faafb5d6b3ce7b70d764de6852caf0_NeikiAnalytics.dll
Size

6KB
MD5

91faafb5d6b3ce7b70d764de6852caf0
SHA1

e0cfba6808645df6e181ae4cad8026850634b318
SHA256

19e86cc6f6b391c5781214119974859cd06f37a84d566e3b5ab278bc80a31bcf
SHA512

c16284aebe1a88da948371222b29242802891af69b4f6e7684900488ce64d35b636a1ef08e2b77a1e228ebc3878b202f1d5ebab485081de8aac340391891f436
SSDEEP

96:DixZjmjtjd8jPjcZGR5TISJXX9wojLzyvIIww/ks:unSR6bgYPvZ1Gk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3596	4072	rundll32.exe	84
PID 4072 wrote to memory of 3596	4072	rundll32.exe	84
PID 4072 wrote to memory of 3596	4072	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91faafb5d6b3ce7b70d764de6852caf0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91faafb5d6b3ce7b70d764de6852caf0_NeikiAnalytics.dll,#1
  2⤵
  PID:3596