f25ea21caed9bc738f045075fb3926041fc0579f8dfeb4bf889e59425b86afeb

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:21

Target

6117d83bbbf2facc85bf76137cd8afd0_NeikiAnalytics.dll
Size

494KB
MD5

6117d83bbbf2facc85bf76137cd8afd0
SHA1

9c070a95e1a30feac88249315f95f92e6aea9243
SHA256

f25ea21caed9bc738f045075fb3926041fc0579f8dfeb4bf889e59425b86afeb
SHA512

6c7c19364bcc18d1a60ff564522764543dcf1a4c4dfab8fec8e4447a793f44067f2cee5d3781547db690de57c5fe1801c31ccc09253d67ca32c656b2ac198253
SSDEEP

12288:7R/CKreJJ8XfhyKSgog0YS/1r7IM1QJqn6643ya:78PJJJaob/1rJ18+6j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 3396	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 3396	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 3396	2000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6117d83bbbf2facc85bf76137cd8afd0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6117d83bbbf2facc85bf76137cd8afd0_NeikiAnalytics.dll,#1
2⤵
PID:3396