54a58c61daa3028007d9b3df3ae244e3e20497062699eb70459e59c5866a3712

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 03:03

Target

92d0a7e3120d2e46bf6ba5c0e9733c20_NeikiAnalytics.dll
Size

5KB
MD5

92d0a7e3120d2e46bf6ba5c0e9733c20
SHA1

d449aac138119af07ab50b7136dad2e911838cb1
SHA256

54a58c61daa3028007d9b3df3ae244e3e20497062699eb70459e59c5866a3712
SHA512

91cf0d4821a39b6929a99d37c582edd80df85f84c22f423bdbbd4e8526356377d5f68a40a4657a21ee807041e6b70e3c1952b2d8b28df08eabf3cd2a3abf3f1c
SSDEEP

24:e31GSByDXy8e53+m//pQVSRvtj49kv/imRg5hHafep9afepENvhafepGi/lmxMxQ:CCy86+Wet9Q/iooHeiefhe+/lSMYEq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1260	2924	rundll32.exe	81
PID 2924 wrote to memory of 1260	2924	rundll32.exe	81
PID 2924 wrote to memory of 1260	2924	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d0a7e3120d2e46bf6ba5c0e9733c20_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d0a7e3120d2e46bf6ba5c0e9733c20_NeikiAnalytics.dll,#1
  2⤵
  PID:1260