a5b394f81b8774857eb4265f3e6db499dfafae4eb8ad19cb48fab412da448d89

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 05:02

Target

8419398e8e05f7f1a85918d522b24030_NeikiAnalytics.dll
Size

72KB
MD5

8419398e8e05f7f1a85918d522b24030
SHA1

425f69f91865f6d563ab641f1db0db7183566f52
SHA256

a5b394f81b8774857eb4265f3e6db499dfafae4eb8ad19cb48fab412da448d89
SHA512

69c997a7be15e6d0972be8b64067a4951d7e4a4239489fd6b3fea3b4ee511bdff5e9d0fd30e2892e683a994dfefb91c0f61ca29502dacdbe27b325a9f94190aa
SSDEEP

384:zqgsxvB5PULK1PlOEo1/TCXrGVsSc9PVjamll1qoSauyAQHo7/+c8Jo96VsK4P:zpsxHjI/TMKkFVjefiHo76Jo9k9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3124	4472	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 4472	1284	rundll32.exe	83
PID 1284 wrote to memory of 4472	1284	rundll32.exe	83
PID 1284 wrote to memory of 4472	1284	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8419398e8e05f7f1a85918d522b24030_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8419398e8e05f7f1a85918d522b24030_NeikiAnalytics.dll,#1
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 600
    3⤵
    - Program crash
    PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4472 -ip 4472
1⤵
PID:1248