3e3a80cff0fc34c60082bc2c5b918756c674a7a48e645a043a707c7fda7a8e9c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 14:02

Target

c99100f88ab4325c93e7a867fbab80c0_NeikiAnalytics.dll
Size

140KB
MD5

c99100f88ab4325c93e7a867fbab80c0
SHA1

69edb173d819f4746ffd079c050d30fddbb9e6fb
SHA256

3e3a80cff0fc34c60082bc2c5b918756c674a7a48e645a043a707c7fda7a8e9c
SHA512

74858acc8f16dc026ff5765a9d4dd87cd0bf1baa3dd022cfae1eb5cffa740fa65f8a5449201475bfffbbf55d47e5646daa5315700d09487c843166f9d5f21d3e
SSDEEP

3072:1S98J2VMmDhjYt1YD+TRK2U/Blg/+LUaFNWNjE9P7ObKN:148JkXhj6Xs225LUWNWNjE9yb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1552	916	rundll32.exe	82
PID 916 wrote to memory of 1552	916	rundll32.exe	82
PID 916 wrote to memory of 1552	916	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99100f88ab4325c93e7a867fbab80c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99100f88ab4325c93e7a867fbab80c0_NeikiAnalytics.dll,#1
  2⤵
  PID:1552