2efaf0f7a20431bef2f1d1e8a0b1b9fd48df43b1acec32a43b0a56ad777aefcb

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 23:45

Target

5b7b4ce7f313049262b99a9bcb478060_NeikiAnalytics.dll
Size

5KB
MD5

5b7b4ce7f313049262b99a9bcb478060
SHA1

02e721353db68dd2680f97993730ad2a8bd1b1b6
SHA256

2efaf0f7a20431bef2f1d1e8a0b1b9fd48df43b1acec32a43b0a56ad777aefcb
SHA512

bc3d9d48fa07804039b362b586fc6c05767f9ac85d1d19875b199083154670b4feb23ee55d6511f606b25e3bab3809a733c99c6575b33e27f64199d487c5ad7e
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqA9XrtRaNXs3TaG8/nnaNdGdh9dlI0lp+Gf:hy859x0P8Ma6D3KNh9dlI0lplB9CMi2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 1716	4648	rundll32.exe	82
PID 4648 wrote to memory of 1716	4648	rundll32.exe	82
PID 4648 wrote to memory of 1716	4648	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b7b4ce7f313049262b99a9bcb478060_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b7b4ce7f313049262b99a9bcb478060_NeikiAnalytics.dll,#1
  2⤵
  PID:1716