d6755c8ef192560842bbb373f6f565a6e0acf9b5914561fd114aec1af57d418c

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 17:15

Target

78f29191afc222e8d80a3cf8b9b48dc0_NeikiAnalytics.dll
Size

98KB
MD5

78f29191afc222e8d80a3cf8b9b48dc0
SHA1

4cdf513c7af5f5db9cdaa3a09890a769ef07f840
SHA256

d6755c8ef192560842bbb373f6f565a6e0acf9b5914561fd114aec1af57d418c
SHA512

a9971e7a3c402a894997b9aeafcca605df09af09e273a20d46e0e65c374aa2dc0fdc43304a6253a9accfa790fbac42ccf76d3efb06e9db48886c78b58888667f
SSDEEP

3072:MeDe6R7TmdDAOZduNyuVIdUJvym21y18rFFN:MweiO5A0Ygui2Jvb2yEN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	2160	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2160	1636	rundll32.exe	83
PID 1636 wrote to memory of 2160	1636	rundll32.exe	83
PID 1636 wrote to memory of 2160	1636	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78f29191afc222e8d80a3cf8b9b48dc0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78f29191afc222e8d80a3cf8b9b48dc0_NeikiAnalytics.dll,#1
  2⤵
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 600
    3⤵
    - Program crash
    PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2160 -ip 2160
1⤵
PID:208