721cd951a9ed525aaf1dd43f4114ce799275a6098cd633d8911c0bdcaf03d58f

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 20:10

Target

1852ed78c933d9426f68de39b11742f0_NeikiAnalytics.dll
Size

152KB
MD5

1852ed78c933d9426f68de39b11742f0
SHA1

488d49ec4f95f83e7ed04102e830e9fc5fd09bf1
SHA256

721cd951a9ed525aaf1dd43f4114ce799275a6098cd633d8911c0bdcaf03d58f
SHA512

b7bb7690079f9de2d82ff75a99fe3c3409adf3d32a7eea3d4e6506c9b9b4507e738c9d0c74c804d68f96f29f92f5f3ec5a20b40167f11c6f5187b813e479c16f
SSDEEP

3072:J7+5EpeJE1P6YTrbUXruOKDhGOtTTBftdPY2:J7JNbbUXr+D7tTTBldPY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3032 1280 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3032	1280	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 8 wrote to memory of 1280	8	rundll32.exe	rundll32.exe
PID 8 wrote to memory of 1280	8	rundll32.exe	rundll32.exe
PID 8 wrote to memory of 1280	8	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1852ed78c933d9426f68de39b11742f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1852ed78c933d9426f68de39b11742f0_NeikiAnalytics.dll,#1
2⤵
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 560
3⤵
- Program crash
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1280 -ip 1280
1⤵
PID:4292