8387e978272538ad190f1d78996b9dee496418fb8b687f83076b6bf92e673163

Analysis

max time kernel
140s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 17:21

Target

bf8c3f39d7c8e347441ad880d3ceb880_NeikiAnalytics.dll
Size

5KB
MD5

bf8c3f39d7c8e347441ad880d3ceb880
SHA1

8fe19bdf8e49eb15e63b7799185525acb70f5a7b
SHA256

8387e978272538ad190f1d78996b9dee496418fb8b687f83076b6bf92e673163
SHA512

97d82af24757d6b59491f8c574e9bd92fd61a74a175aac77b63712e9329f1d4ea2d167dc1f5da95b3d0f9372e424792a763e7af31f0fad93c5252e5eb7a885af
SSDEEP

48:SASAl6a98rtNVhWOZU8tOZGKs3JUFOIRiee/SY2qkUcHPuq6DcJ1Ta0bS:f8rv2OZVtOZds3OFOIRxe/hSU0UO1Te

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 4676	2936	rundll32.exe	83
PID 2936 wrote to memory of 4676	2936	rundll32.exe	83
PID 2936 wrote to memory of 4676	2936	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf8c3f39d7c8e347441ad880d3ceb880_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf8c3f39d7c8e347441ad880d3ceb880_NeikiAnalytics.dll,#1
  2⤵
  PID:4676