a2c244d4cbd89d06d5a6353435e4bfd924d9e4f3ef66620289e8fd423c4333cc

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 07:17

Target

cca231c2787984291e0892c6d17fe300_NeikiAnalytics.dll
Size

1.1MB
MD5

cca231c2787984291e0892c6d17fe300
SHA1

32021d07621115f9f96663673a1663d21e602c86
SHA256

a2c244d4cbd89d06d5a6353435e4bfd924d9e4f3ef66620289e8fd423c4333cc
SHA512

754029f5b2376e49eee85d5f553dd9586c02730c99250261a772e0ba17d62994b11c3526835d071df7e0beb7953d5d8f1ec4af1ac5db7cbac1304993557baf66
SSDEEP

24576:y7Tz9dlGW/uMK5BwHnhg8l6bSI8WzzE8PCjSVRWrAWQvi:kdX9aSvt8PCjIvWQvi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3932	4832	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4832	5024	rundll32.exe	83
PID 5024 wrote to memory of 4832	5024	rundll32.exe	83
PID 5024 wrote to memory of 4832	5024	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cca231c2787984291e0892c6d17fe300_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cca231c2787984291e0892c6d17fe300_NeikiAnalytics.dll,#1
  2⤵
  PID:4832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 604
    3⤵
    - Program crash
    PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 4832
1⤵
PID:2780