4d05214b4b82784b28f064dd6f3de6795f136c60a0b849e3309aa55c677044c1

Analysis

max time kernel
124s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 08:59

Target

ac517f6c57b313a4a40405009af7d600_NeikiAnalytics.dll
Size

547KB
MD5

ac517f6c57b313a4a40405009af7d600
SHA1

a34ccd66b75b3e67c6caf74d6a7076f6dd52d59e
SHA256

4d05214b4b82784b28f064dd6f3de6795f136c60a0b849e3309aa55c677044c1
SHA512

d8c235318205b8dbff66f1ca70c6900f36de035ef2658de0695b306a1908702370e3d3f15af262a93288f63373422ccc14c1f4da495ee474ed7c5b309b2e37f7
SSDEEP

12288:UL8I0S9UVzhv2SSN5ITAKQUH9dNjZ8PDCajp9PGGm1ws:UL8XsfIkKHjqLNUjw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2120	3708	rundll32.exe	84
PID 3708 wrote to memory of 2120	3708	rundll32.exe	84
PID 3708 wrote to memory of 2120	3708	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac517f6c57b313a4a40405009af7d600_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac517f6c57b313a4a40405009af7d600_NeikiAnalytics.dll,#1
  2⤵
  PID:2120