480d2f5adeeb5207a15d51c728188762b3d18d3e96e9edb490fa6c32d30aa675

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 05:52

Target

3d70bf9827b6f54867a54bad14abe6f0_NeikiAnalytics.dll
Size

211KB
MD5

3d70bf9827b6f54867a54bad14abe6f0
SHA1

b33780dfda07575ae84ff337993afa0a922e044d
SHA256

480d2f5adeeb5207a15d51c728188762b3d18d3e96e9edb490fa6c32d30aa675
SHA512

7f062d3fa3f0cc35a122ecd515a796e3a605ff6023d63855571e58488d948991599d4eb44b9f92572f3d96148507395a468e183b8323e82e39d5baee2de3d7a9
SSDEEP

6144:fMAzTAcVzigig4kvo1hfpzGygBcVz3ulG:fMA3AcVue4j3uA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
380	3340	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3340	4044	rundll32.exe	82
PID 4044 wrote to memory of 3340	4044	rundll32.exe	82
PID 4044 wrote to memory of 3340	4044	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d70bf9827b6f54867a54bad14abe6f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d70bf9827b6f54867a54bad14abe6f0_NeikiAnalytics.dll,#1
  2⤵
  PID:3340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 628
    3⤵
    - Program crash
    PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3340 -ip 3340
1⤵
PID:3260

memory/3340-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download