f5230c3db99d26c391f961a2aebf16c1e8faf6bc40413c35a92da8e093528949

Analysis

max time kernel
134s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:34

Target

4d7a4ea88d03d6785f75848e6b8abac0_NeikiAnalytics.dll
Size

81KB
MD5

4d7a4ea88d03d6785f75848e6b8abac0
SHA1

5adce51bd2ca83be3f6bdc152b18abccdae83086
SHA256

f5230c3db99d26c391f961a2aebf16c1e8faf6bc40413c35a92da8e093528949
SHA512

ddba438b8f631509a1e2108a4b2c4eab312057b048abb7474bd389e619a06b399874e53fdb9b3155ec08d41c96d07dd168436a1cca0f300a83025d45011e65b1
SSDEEP

1536:NtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8W3:N4v4JKXTx71w0ArSsXF3enq8W3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5348 wrote to memory of 4600	5348	rundll32.exe	rundll32.exe
PID 5348 wrote to memory of 4600	5348	rundll32.exe	rundll32.exe
PID 5348 wrote to memory of 4600	5348	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d7a4ea88d03d6785f75848e6b8abac0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d7a4ea88d03d6785f75848e6b8abac0_NeikiAnalytics.dll,#1
2⤵
PID:4600