51cba2b9ecc1513a10cafdeb6030c665b1b8d1ae2a1b3fabb58ff2e946a4cbfe

Analysis

max time kernel
93s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 13:57

Target

c95d35b059c5cd5de78d0eeeeaa274f0_NeikiAnalytics.dll
Size

6KB
MD5

c95d35b059c5cd5de78d0eeeeaa274f0
SHA1

56c4e1f19fd4dc1ee7eb94ab0224aa82d3a981de
SHA256

51cba2b9ecc1513a10cafdeb6030c665b1b8d1ae2a1b3fabb58ff2e946a4cbfe
SHA512

585889f25641b35db1ecd5458e446f9d7e3386aa49712fecbd5b4294ac96c72b9007331d41013790fca91842a7d9be00fec8ecd32a8f7c9b6289eb986e739f08
SSDEEP

48:SsGp63gAST0cMLlD7prUlG9Nzg72mSyl+ONSgZR+AReMH:VGEETrMLH5QBSylRSuR+AReM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 112	3192	rundll32.exe	82
PID 3192 wrote to memory of 112	3192	rundll32.exe	82
PID 3192 wrote to memory of 112	3192	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c95d35b059c5cd5de78d0eeeeaa274f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c95d35b059c5cd5de78d0eeeeaa274f0_NeikiAnalytics.dll,#1
  2⤵
  PID:112