ec19bba5bd1359f8d8ab754cc1d16b64de212641421026ef915c453745a1c73a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 04:46

Target

aae89c0abf70b2710b42ce5ff772e040_NeikiAnalytics.dll
Size

81KB
MD5

aae89c0abf70b2710b42ce5ff772e040
SHA1

24466ade7e67d06af2bec2a2917cebba553e8af0
SHA256

ec19bba5bd1359f8d8ab754cc1d16b64de212641421026ef915c453745a1c73a
SHA512

0fd78c9691dfee64ea044af7ecb2791265c422e250d7bcc969572f043b285a47369fb7628f99d8009bc31ac52625a4e413850ffc7149e8cadb8114d5669c6a33
SSDEEP

1536:HtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WX:H4v4JKXTx71w0ArSsXF3enq8WX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 3172	1324	rundll32.exe	83
PID 1324 wrote to memory of 3172	1324	rundll32.exe	83
PID 1324 wrote to memory of 3172	1324	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aae89c0abf70b2710b42ce5ff772e040_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aae89c0abf70b2710b42ce5ff772e040_NeikiAnalytics.dll,#1
  2⤵
  PID:3172