648ac8f868d545d7dfecfb89fad13471d1ea4118e4791efeb9cf93f1ee253f16

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 02:30

Target

8aae2b8b86e202513fa562157370ec10_NeikiAnalytics.dll
Size

1.9MB
MD5

8aae2b8b86e202513fa562157370ec10
SHA1

e9716aaf92262c9a5551ecbab3711e3f02b40cd7
SHA256

648ac8f868d545d7dfecfb89fad13471d1ea4118e4791efeb9cf93f1ee253f16
SHA512

c9ca6c956fd64ee23d734de4e22d3a6937edda09b3e8d9abb528a645ce949e31b52b4c3e51fa2a2ecb6bec1595eb6c76c046bf19d9389c80a9a4db4742558aab
SSDEEP

49152:jjTh5K+JkeTFUlyyi1APXpG+6IDJodTgEOTM9o0Kf7VDhu:P15DkkqlzPX1odYzE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3544	3420	rundll32.exe	82
PID 3420 wrote to memory of 3544	3420	rundll32.exe	82
PID 3420 wrote to memory of 3544	3420	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8aae2b8b86e202513fa562157370ec10_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8aae2b8b86e202513fa562157370ec10_NeikiAnalytics.dll,#1
  2⤵
  PID:3544