165c9d307a10b39276a842bd49e8d104b30bd5decf92a7c93d19efbaa3cc8705

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 22:02

Target

472630f89e58e926f0d3c9245ec27860_NeikiAnalytics.dll
Size

72KB
MD5

472630f89e58e926f0d3c9245ec27860
SHA1

4a0b742bbdae508e2ae5dd818841b8d77a490641
SHA256

165c9d307a10b39276a842bd49e8d104b30bd5decf92a7c93d19efbaa3cc8705
SHA512

684b45fefb002c02050e1b39661eb801b863e1decfb550bdfb656f0ed1490a0801333c65b1615c82831f9b5b4361b98a3fb173867122a75e4b85cfbe5689e9f6
SSDEEP

1536:YgZL9S5PzVfP5VHAnToIfjIOlIOuiLYhA:YgZLAB5V0TBfFvuiLYhA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3116	1972	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 1972	464	rundll32.exe	83
PID 464 wrote to memory of 1972	464	rundll32.exe	83
PID 464 wrote to memory of 1972	464	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\472630f89e58e926f0d3c9245ec27860_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\472630f89e58e926f0d3c9245ec27860_NeikiAnalytics.dll,#1
  2⤵
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 600
    3⤵
    - Program crash
    PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1972 -ip 1972
1⤵
PID:5004