16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 07:09

Target

16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7_NeikiAnalytics.dll
Size

81KB
MD5

05c3b9165a1cfb20e1b565725c4414c0
SHA1

cd844d4c7fc748b54fdd86f2f43526e0747be4f2
SHA256

16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7
SHA512

008378ccd177aabc93f159ce00db20e5bdb154d8ff2f51b3d426f9058d64027f6d73b837092f84f7085d2a3d008deae0771c780492e46ba698bfb75ef85d1e9f
SSDEEP

1536:YtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wm:Y4v4JKXTx71w0ArSsXF3enq8Wm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 1164	2812	rundll32.exe	83
PID 2812 wrote to memory of 1164	2812	rundll32.exe	83
PID 2812 wrote to memory of 1164	2812	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7_NeikiAnalytics.dll,#1
  2⤵
  PID:1164