ea6f1bbabc5baa9ba5891357c6582bb170dc88e43d6642e8e15a372625216f76

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:04

Target

68cc535cb1a49a92d8931005e1ff5080_NeikiAnalytics.dll
Size

220KB
MD5

68cc535cb1a49a92d8931005e1ff5080
SHA1

0a02408b89c8a6fbd36e5b2ec717128ac0b2b867
SHA256

ea6f1bbabc5baa9ba5891357c6582bb170dc88e43d6642e8e15a372625216f76
SHA512

3fed68f74fe500a9ebaa1f108d78defdfbb4bce1bbb5d72c2d3a9c472d4529a2c857dfe7cdc2afa6571e84eeba3a8281e541eb714be403952738ce99a361ca8f
SSDEEP

6144:igphTMgiD7Wlqm3fXwQ3BsaL+dZtLzhVj7n3Lp4CNleTdWZ/gxZrvHHU2WUAKY:aD7Wlqm3M5/n3Lp4CHeTdWZ/gxZrvHHp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2152 wrote to memory of 3944	2152	rundll32.exe	rundll32.exe
PID 2152 wrote to memory of 3944	2152	rundll32.exe	rundll32.exe
PID 2152 wrote to memory of 3944	2152	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68cc535cb1a49a92d8931005e1ff5080_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68cc535cb1a49a92d8931005e1ff5080_NeikiAnalytics.dll,#1
2⤵
PID:3944