97bcfe703ea42a3fd4160f8169788884ec242bedff34ecb602555f971e9d02f9

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:16

Target

046b035f454b5ad2261afe9b8e01c8c0_NeikiAnalytics.dll
Size

81KB
MD5

046b035f454b5ad2261afe9b8e01c8c0
SHA1

c3dd96b5961478f36c836fb302e9d9adf597dc8d
SHA256

97bcfe703ea42a3fd4160f8169788884ec242bedff34ecb602555f971e9d02f9
SHA512

6a9737a947b42a2be221f0f62013c6e72efbefc8dc403f1474083256ea141efc31a434d1bc475472052e30d4608e81ba7c6c485812f2c67503f222dc9ac09c3a
SSDEEP

1536:1tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wu:14v4JKXTx71w0ArSsXF3enq8Wu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3204 wrote to memory of 3644	3204	rundll32.exe	rundll32.exe
PID 3204 wrote to memory of 3644	3204	rundll32.exe	rundll32.exe
PID 3204 wrote to memory of 3644	3204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\046b035f454b5ad2261afe9b8e01c8c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\046b035f454b5ad2261afe9b8e01c8c0_NeikiAnalytics.dll,#1
  2⤵
  PID:3644