5f173a5ffcd27f7a76171b5d783fd84b927b9622bed722a6d620b1e5ac6c077e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 02:57

Target

916718971584bcd3e446d65ea5772e80_NeikiAnalytics.dll
Size

6KB
MD5

916718971584bcd3e446d65ea5772e80
SHA1

19eb467dd5530172b205debf7a75319c149813e2
SHA256

5f173a5ffcd27f7a76171b5d783fd84b927b9622bed722a6d620b1e5ac6c077e
SHA512

9c34a50810392995ce1b0d6d655435a1922d4e3187eec3b8859cf22a73c84cec39e9a02745b92370d819b4dc36bbc4daa4db8d8b6cfab9087d27ddbb870f0ecc
SSDEEP

96:0YKwyE4TNwOE42YFwOE42YHIC5InQl3Swzo9CcJgV:0hPICIiz2QkX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	5112	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 5112	3676	rundll32.exe	83
PID 3676 wrote to memory of 5112	3676	rundll32.exe	83
PID 3676 wrote to memory of 5112	3676	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\916718971584bcd3e446d65ea5772e80_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\916718971584bcd3e446d65ea5772e80_NeikiAnalytics.dll,#1
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 564
    3⤵
    - Program crash
    PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5112 -ip 5112
1⤵
PID:3984