1f6ee07959268978d0888e33a1e83dc78a2d81ce6c7b6788062c34a42dce531a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 06:41

Target

b3b970de8c8393a843c4919eb2b044b0_NeikiAnalytics.dll
Size

6KB
MD5

b3b970de8c8393a843c4919eb2b044b0
SHA1

0779260ccf886aa3da8a5d515adee2edf1a24ed5
SHA256

1f6ee07959268978d0888e33a1e83dc78a2d81ce6c7b6788062c34a42dce531a
SHA512

90b59f72f2a395e607f0358bc8b073184949e4f14d3f0677a564c3a9fe651b6ca33dbe4ef5cbd0cbdc1597717030739478490a839aa18a56ad0e2f9dc490baa0
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIGnu78QHLJTl9YrTNcYGEJ5jR:unSR6bgYlWrBwyE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 4688	1404	rundll32.exe	82
PID 1404 wrote to memory of 4688	1404	rundll32.exe	82
PID 1404 wrote to memory of 4688	1404	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3b970de8c8393a843c4919eb2b044b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3b970de8c8393a843c4919eb2b044b0_NeikiAnalytics.dll,#1
  2⤵
  PID:4688