aa38986a5ed7b51f58c86637f411ead5498b6faefcb21c0da41222ad5be14617

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 17:20

Target

bf83ce2d241c12a05a8152184e18ae10_NeikiAnalytics.dll
Size

1.6MB
MD5

bf83ce2d241c12a05a8152184e18ae10
SHA1

e70e38fa04c43f2b9496d40ac610226ab8b82f78
SHA256

aa38986a5ed7b51f58c86637f411ead5498b6faefcb21c0da41222ad5be14617
SHA512

309dea235ccd88d330ff4abd92e0ba3082470b6dd3d1590c0c7a717fdc4850ace38ad1b0ee6e9517cc55b29f6f6abc975a5703820d6627505ec2dc6bd61f78ff
SSDEEP

24576:ESigvwL2ctDMjo5Aku347FWyVdEOLInqy:ZUBQs434/en1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1096	3680	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3680	4460	rundll32.exe	80
PID 4460 wrote to memory of 3680	4460	rundll32.exe	80
PID 4460 wrote to memory of 3680	4460	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf83ce2d241c12a05a8152184e18ae10_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf83ce2d241c12a05a8152184e18ae10_NeikiAnalytics.dll,#1
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 684
    3⤵
    - Program crash
    PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3680 -ip 3680
1⤵
PID:4244

memory/3680-0-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download