f93e788c0fea224c65f79474dd7dc10c21116f05175a389f556edcdfd35a7385

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:00

Target

528c937a09d983affc312675ff181e50_NeikiAnalytics.dll
Size

81KB
MD5

528c937a09d983affc312675ff181e50
SHA1

0a0baac4cf84fb06798f3c49f3a334be9db91e7f
SHA256

f93e788c0fea224c65f79474dd7dc10c21116f05175a389f556edcdfd35a7385
SHA512

551448b34e94e33d53b1a510ece4bb6b4185e2b48e74f819aa34a657cca5ddaa16941d398f68250ab663832190e3e7b8672171594029824429c9e13607afb766
SSDEEP

1536:btByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WI:b4v4JKXTx71w0ArSsXF3enq8WI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5072 wrote to memory of 5444	5072	rundll32.exe	rundll32.exe
PID 5072 wrote to memory of 5444	5072	rundll32.exe	rundll32.exe
PID 5072 wrote to memory of 5444	5072	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\528c937a09d983affc312675ff181e50_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\528c937a09d983affc312675ff181e50_NeikiAnalytics.dll,#1
  2⤵
  PID:5444