d13baf24ccea8cbb3f7b2eff8cde2e65b8647668fda745e46da924401eb6afc8

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 08:50

Target

cd3ceb2efc17c7b32664537fef03ceb0_NeikiAnalytics.dll
Size

26KB
MD5

cd3ceb2efc17c7b32664537fef03ceb0
SHA1

5739bf3a5ae505c7419b8282505b8faacdc68b88
SHA256

d13baf24ccea8cbb3f7b2eff8cde2e65b8647668fda745e46da924401eb6afc8
SHA512

286b82635fcf59282d283fcf1b92474c3e3d3f37ee94ab873f4281bb179b79c62a35bf3c29c11b0caf7d5701d3eb74ec63fe114a77f105a8d20728b4dc061916
SSDEEP

384:fhO8CzA3gKrnaTIIYhz3rProZnbjQhYgN4gNqLSKA3Aaa/dx624qVIHlUrpJHyme:fhrRaTIIY93rPoywaM624qaFEjY+G

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 1416	3828	rundll32.exe	83
PID 3828 wrote to memory of 1416	3828	rundll32.exe	83
PID 3828 wrote to memory of 1416	3828	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd3ceb2efc17c7b32664537fef03ceb0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd3ceb2efc17c7b32664537fef03ceb0_NeikiAnalytics.dll,#1
  2⤵
  PID:1416