562a45fa08603ab86dccec258d8412590d2dd4c55abcdd5b779a0b380ba3dc39

Analysis

max time kernel
134s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 13:30

Target

562a45fa08603ab86dccec258d8412590d2dd4c55abcdd5b779a0b380ba3dc39_NeikiAnalytics.dll
Size

81KB
MD5

ad00608c70c9c1b5055ee3410600a110
SHA1

bd665df53186c281220dd16dd6082cbdd40dbde5
SHA256

562a45fa08603ab86dccec258d8412590d2dd4c55abcdd5b779a0b380ba3dc39
SHA512

ff0fe2c2e190a90a1cf0308cb6a41ea41515d433ab82f66185c8245dcd4a68328bc28ea920390df43be423ab00d38b8e1fb3ce4ed7aaaa3fda08cd9f033b9579
SSDEEP

1536:xc+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GU:m+5oxmqAiR8+/RBkez0U+7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 4340	2556	rundll32.exe	86
PID 2556 wrote to memory of 4340	2556	rundll32.exe	86
PID 2556 wrote to memory of 4340	2556	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\562a45fa08603ab86dccec258d8412590d2dd4c55abcdd5b779a0b380ba3dc39_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\562a45fa08603ab86dccec258d8412590d2dd4c55abcdd5b779a0b380ba3dc39_NeikiAnalytics.dll,#1
  2⤵
  PID:4340