1d96a47f2d88a2971fd64ee7a2e5898749296becdd0f33068192e35182aaac1c

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 02:35

Target

791671c25f0e32279b184ba3c55f9750_NeikiAnalytics.dll
Size

300KB
MD5

791671c25f0e32279b184ba3c55f9750
SHA1

a54de0cb393ec5cf12304d7cb014f856d81ea097
SHA256

1d96a47f2d88a2971fd64ee7a2e5898749296becdd0f33068192e35182aaac1c
SHA512

c7d41a258f1e69e09c083497cd7a6dd06fe799e9e6b01fe9f639b7d1d7fdb9affe3f8e0cb3bedf8a25fb2328ab92175d8ef488d68b7793047361e560a29e6e40
SSDEEP

3072:Bvplby1pQ/4e7C8KW5AkcQNCd/SwJJ7CV8h4ObzvEApEfVc+nAcxM2U+ABY9KOJ8:JUpQQ5BW5ABrpDzvOc+BM2U+5Y7BYu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
412	4932	WerFault.exe	84

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4736	1684	rundll32.exe	83
PID 1684 wrote to memory of 4736	1684	rundll32.exe	83
PID 1684 wrote to memory of 4736	1684	rundll32.exe	83
PID 4736 wrote to memory of 4932	4736	rundll32.exe	84
PID 4736 wrote to memory of 4932	4736	rundll32.exe	84
PID 4736 wrote to memory of 4932	4736	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\791671c25f0e32279b184ba3c55f9750_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\791671c25f0e32279b184ba3c55f9750_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\791671c25f0e32279b184ba3c55f9750_NeikiAnalytics.dll,#1
    3⤵
    PID:4932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 544
      4⤵
      Program crash
      PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4932 -ip 4932
1⤵
PID:4888