2f043486638377dae8b005fa5d258c6aa437e689af54f5ec5d00ce23fd50d270

Analysis

max time kernel
131s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 07:06

Target

b894569c61e5c110ec2c018802780e20_NeikiAnalytics.dll
Size

38KB
MD5

b894569c61e5c110ec2c018802780e20
SHA1

9abc007d6a6120264a83687247997256ce932c81
SHA256

2f043486638377dae8b005fa5d258c6aa437e689af54f5ec5d00ce23fd50d270
SHA512

a68dfc4db8b77c680db2497d83ba09d8fc36af71bbac0b1494f00ed40d046d7a9c57d84349e0303258637bd579e6eea6341d4c634d754d80b5bc85dd26d219eb
SSDEEP

768:gR2Nr23COLK8wla/T4Jfl52HT6tHf+2PlvD0qX9eipPzbXttcYqvq:SYq3HLK8w24tfXx0qX9eitbXLqvq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	208	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 208	4284	rundll32.exe	84
PID 4284 wrote to memory of 208	4284	rundll32.exe	84
PID 4284 wrote to memory of 208	4284	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b894569c61e5c110ec2c018802780e20_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b894569c61e5c110ec2c018802780e20_NeikiAnalytics.dll,#1
  2⤵
  PID:208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 548
    3⤵
    - Program crash
    PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 208 -ip 208
1⤵
PID:4812

memory/208-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download