0f84e937df59cab5a90aa8b387cfe0a2c0dc5a6aedd58201a2d2771c3efd06f1

Analysis

max time kernel
131s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 03:48

Target

437c5ec21285313fe5942a7ebeecb640_NeikiAnalytics.dll
Size

140KB
MD5

437c5ec21285313fe5942a7ebeecb640
SHA1

0be1c475f345d9bc474991e70654860c471e2fc0
SHA256

0f84e937df59cab5a90aa8b387cfe0a2c0dc5a6aedd58201a2d2771c3efd06f1
SHA512

14b94b21a5fc82c3991350125b9323579eb5f89cc6de54146cde55ecbe706191462b89645a1c2a640fdfc90dc5993e87bc08ad5514b5626c9adae9069588276c
SSDEEP

3072:zts5KomXJeIaYAssh/eF9Db2tHkCmii6jO:zeWdwyx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4888	3972	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3972	1620	rundll32.exe	83
PID 1620 wrote to memory of 3972	1620	rundll32.exe	83
PID 1620 wrote to memory of 3972	1620	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\437c5ec21285313fe5942a7ebeecb640_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\437c5ec21285313fe5942a7ebeecb640_NeikiAnalytics.dll,#1
  2⤵
  PID:3972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 600
    3⤵
    - Program crash
    PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3972 -ip 3972
1⤵
PID:2580

memory/3972-0-0x0000000074DA0000-0x0000000074DC0000-memory.dmp

Filesize
128KB

Download