fe0db2eb82cf6dd60bb39d4ea3d3e08f1af59e71a5f0fe1930c5af078c8aa81e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 03:18

Target

96a31016f5f43f0c85b490490b1b53f0_NeikiAnalytics.dll
Size

2.3MB
MD5

96a31016f5f43f0c85b490490b1b53f0
SHA1

4992aa481ae7b9aee1621ccd7a983a0d79337461
SHA256

fe0db2eb82cf6dd60bb39d4ea3d3e08f1af59e71a5f0fe1930c5af078c8aa81e
SHA512

063b17b019c14dccf9f61aa1148ec7bbd01e9e81a1dace4503b2045ac5ec39686d878754bc703a4275485953360a9f8041a004dec676bcaff3fd459af002ebc1
SSDEEP

49152:9dJlFVHMF4A+tcqh1nNmUHf4llixNUdilP7AJBe6:9d7FVHAUcK1nNT/4lCka

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 2660	3812	rundll32.exe	83
PID 3812 wrote to memory of 2660	3812	rundll32.exe	83
PID 3812 wrote to memory of 2660	3812	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96a31016f5f43f0c85b490490b1b53f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96a31016f5f43f0c85b490490b1b53f0_NeikiAnalytics.dll,#1
  2⤵
  PID:2660

memory/2660-1-0x0000000000E80000-0x0000000000E86000-memory.dmp

Filesize
24KB

Download
memory/2660-0-0x0000000010000000-0x0000000010242000-memory.dmp

Filesize
2.3MB

Download
memory/2660-3-0x0000000002C60000-0x0000000002D8A000-memory.dmp

Filesize
1.2MB

Download
memory/2660-4-0x0000000002D90000-0x0000000002E9E000-memory.dmp

Filesize
1.1MB

Download
memory/2660-5-0x0000000002D90000-0x0000000002E9E000-memory.dmp

Filesize
1.1MB

Download
memory/2660-7-0x0000000002D90000-0x0000000002E9E000-memory.dmp

Filesize
1.1MB

Download
memory/2660-8-0x0000000010000000-0x0000000010242000-memory.dmp

Filesize
2.3MB

Download
memory/2660-10-0x0000000002D90000-0x0000000002E9E000-memory.dmp

Filesize
1.1MB

Download
memory/2660-11-0x0000000002EA0000-0x0000000004825000-memory.dmp

Filesize
25.5MB

Download
memory/2660-12-0x0000000004830000-0x000000000492D000-memory.dmp

Filesize
1012KB

Download
memory/2660-14-0x0000000004930000-0x0000000004A38000-memory.dmp

Filesize
1.0MB

Download
memory/2660-17-0x0000000004930000-0x0000000004A38000-memory.dmp

Filesize
1.0MB

Download
memory/2660-18-0x0000000000AE0000-0x0000000000AE2000-memory.dmp

Filesize
8KB

Download
memory/2660-19-0x000000003E770000-0x000000003E774000-memory.dmp

Filesize
16KB

Download