53f488eb90139f1e7ac44d5c4dc3559d219e613691df1713b35a792c3c1a289f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:45

Target

5ace3a3d61f4f2b28242c8e5595c0500_NeikiAnalytics.dll
Size

1.9MB
MD5

5ace3a3d61f4f2b28242c8e5595c0500
SHA1

43eddfdca1807e650e77a968c1420785b59f92e2
SHA256

53f488eb90139f1e7ac44d5c4dc3559d219e613691df1713b35a792c3c1a289f
SHA512

634720c5c562e73171365b890ed2b28a4ba8ecd1970def0a99d3086acfd282193302f39fa5b6959484cdf54545b723f793b36fb4a36540399acbbcbdbb30e928
SSDEEP

49152:hLLCtzvr9Y7WWT1V2zyuIeRSYKBhB7vo+B:d4Y/TXYyNeRALxv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3200 wrote to memory of 5004	3200	rundll32.exe	rundll32.exe
PID 3200 wrote to memory of 5004	3200	rundll32.exe	rundll32.exe
PID 3200 wrote to memory of 5004	3200	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ace3a3d61f4f2b28242c8e5595c0500_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ace3a3d61f4f2b28242c8e5595c0500_NeikiAnalytics.dll,#1
2⤵
PID:5004

memory/5004-0-0x0000000000810000-0x0000000000816000-memory.dmp

Filesize
24KB

Download
memory/5004-1-0x0000000010000000-0x00000000101E8000-memory.dmp

Filesize
1.9MB

Download
memory/5004-3-0x0000000002450000-0x000000000255F000-memory.dmp

Filesize
1.1MB

Download
memory/5004-4-0x0000000002560000-0x0000000002655000-memory.dmp

Filesize
980KB

Download
memory/5004-7-0x0000000002560000-0x0000000002655000-memory.dmp

Filesize
980KB

Download
memory/5004-8-0x0000000010000000-0x00000000101E8000-memory.dmp

Filesize
1.9MB

Download
memory/5004-10-0x0000000002560000-0x0000000002655000-memory.dmp

Filesize
980KB

Download
memory/5004-11-0x0000000002660000-0x00000000045FC000-memory.dmp

Filesize
31.6MB

Download
memory/5004-12-0x0000000004600000-0x00000000046E4000-memory.dmp

Filesize
912KB

Download
memory/5004-13-0x00000000046F0000-0x00000000047D2000-memory.dmp

Filesize
904KB

Download
memory/5004-16-0x00000000046F0000-0x00000000047D2000-memory.dmp

Filesize
904KB

Download
memory/5004-17-0x00000000003B0000-0x00000000003B2000-memory.dmp

Filesize
8KB

Download
memory/5004-18-0x000000001C130000-0x000000001C134000-memory.dmp

Filesize
16KB

Download