6cd947309785e2c928f9fcf1b23c3e4abe64fa6d0d561740bfea915583d0f99c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 10:39

Target
aa79704312943a79c62c6f0cd552b570_NeikiAnalytics.dll
Size 73KB
Sample240525-mp2z3aec62
SHA256 6cd947309785e2c928f9fcf1b23c3e4abe64fa6d0d561740bfea915583d0f99c
MD5 aa79704312943a79c62c6f0cd552b570
SHA1 213bb7fdeb954fa7ddd064cd37364960d4002c43
SHA512 4a999b3ccb31f4bf598d49a3883a8e0a5539635054bbec56b0a6fdb99919e86a25db5ca86e62847dea6151352e22bd8c9ff3346a0a5266facc3e427b7dce3b43
SSDEEP 1536:hZZZZZZZZZZZZpyORgbwS7FGqmQx1Y7qcJK61hMqqU+2bbbAV2/S2uXKEi:vRGrLY7qct1hMqqDL2/uXK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	3532	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3532	2988	rundll32.exe	83
PID 2988 wrote to memory of 3532	2988	rundll32.exe	83
PID 2988 wrote to memory of 3532	2988	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa79704312943a79c62c6f0cd552b570_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa79704312943a79c62c6f0cd552b570_NeikiAnalytics.dll,#1
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 624
    3⤵
    - Program crash
    PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3532 -ip 3532
1⤵
PID:4004