c0d51476f7bda4eb0eff7390a487757d841667bba5c8273e42aea19b4d03f51e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 15:17

Target

cbf6aad5dded08c163a95aec9f4cc9f0_NeikiAnalytics.dll
Size

297KB
MD5

cbf6aad5dded08c163a95aec9f4cc9f0
SHA1

99a4752aee1d67b89dcb29e40cefd24350da2fb9
SHA256

c0d51476f7bda4eb0eff7390a487757d841667bba5c8273e42aea19b4d03f51e
SHA512

d7fc7d71412be765b84085c1dab6c462b3db8d39249dad985172b69158e3e6d54ba9d85d56969373af8cf9d8ddfc10882ad460a04ad2c0dffaf675afd58eb1c0
SSDEEP

3072:6xagFT1gQVFYI3Tsx5kPpv3o91oR2tjCm2ENG9o7icc0AsVY23sX9E:6xag1VA+Bv36oRmjjt8yc0AsVhY9E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 4808	1708	rundll32.exe	84
PID 1708 wrote to memory of 4808	1708	rundll32.exe	84
PID 1708 wrote to memory of 4808	1708	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbf6aad5dded08c163a95aec9f4cc9f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbf6aad5dded08c163a95aec9f4cc9f0_NeikiAnalytics.dll,#1
  2⤵
  PID:4808