032a9df66ffc2f8a6e2b77441c3b40b213694fd62d7de3237e68774da99298cf

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 11:51

Target

c54880abb963d7658500e575864be4b0_NeikiAnalytics.dll
Size

6KB
MD5

c54880abb963d7658500e575864be4b0
SHA1

dcdbfee62d58bebb862f60524d6e0b7b926afade
SHA256

032a9df66ffc2f8a6e2b77441c3b40b213694fd62d7de3237e68774da99298cf
SHA512

5d7588629378fd02d07697048f2d778d9c2a90c91803fcadd8c45e900fd58ffba925561821c6c45340ea8b14c913f4d28abdb6dfc21bf542c2512cde3ddbc027
SSDEEP

96:hy859x0P8Maeg63oieZ7fA/HTLeQWJVnqRT/408Sj7sf6yF68:F5oL/3deZ7fecnqRlFj7sf6yQ8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1204	2956	rundll32.exe	82
PID 2956 wrote to memory of 1204	2956	rundll32.exe	82
PID 2956 wrote to memory of 1204	2956	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c54880abb963d7658500e575864be4b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c54880abb963d7658500e575864be4b0_NeikiAnalytics.dll,#1
  2⤵
  PID:1204