8661c6b4509799ded640cfa6a523c13de5a9a547524b9b0efb0d12afb8391432

Analysis

max time kernel
139s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 06:05

Target

ac6476e0961ea666814d955e254df3d0_NeikiAnalytics.dll
Size

81KB
MD5

ac6476e0961ea666814d955e254df3d0
SHA1

2e4f158e7247f063b8010bba5dc00ab96faf3969
SHA256

8661c6b4509799ded640cfa6a523c13de5a9a547524b9b0efb0d12afb8391432
SHA512

a8501f38ab3020c0ee654c2fbcab67e1365e84e1bfa6c1f2e2520d835d9adf44fde7c7a89f7fe7cd2d4abc75b87f7ad20a321fd916bf28c5eeacf744d030e458
SSDEEP

1536:atByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WZ:a4v4JKXTx71w0ArSsXF3enq8WZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1044	4556	rundll32.exe	82
PID 4556 wrote to memory of 1044	4556	rundll32.exe	82
PID 4556 wrote to memory of 1044	4556	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac6476e0961ea666814d955e254df3d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac6476e0961ea666814d955e254df3d0_NeikiAnalytics.dll,#1
  2⤵
  PID:1044