73535b3e386f604727b62b63a0c039e56d773e7b40d390e53a61ec72166843bf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 21:43

Target

2e795acc45ad5118cf18fa6fbdb90f60_NeikiAnalytics.dll
Size

100KB
MD5

2e795acc45ad5118cf18fa6fbdb90f60
SHA1

17d85e74bbfd350d90f63d73773a0ead096142bc
SHA256

73535b3e386f604727b62b63a0c039e56d773e7b40d390e53a61ec72166843bf
SHA512

e4133d50cfbf35123893051262b7457522b1ac63bde0e50de0c69b5b0b72f08b4687bf3cf70fbed1a00bc332f7a2895507733fe64802484d08a3b340724b489c
SSDEEP

1536:F+gQcGlo/4T8dF8yT6iQpMLE/JjLJMholxhNLaox8K2qZpckQ9Cq:F17Glqt++6ieMwPJMcxmox8xspckQk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 448	1332	rundll32.exe	82
PID 1332 wrote to memory of 448	1332	rundll32.exe	82
PID 1332 wrote to memory of 448	1332	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e795acc45ad5118cf18fa6fbdb90f60_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e795acc45ad5118cf18fa6fbdb90f60_NeikiAnalytics.dll,#1
  2⤵
  PID:448