4390ca70996eb2d2cd95d97b503dc07535cc37701cdd352d8a7972ca2af5bc47

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 23:24

Target
0bcd7d9656f89fb4fd7e365b6d8d2df0_NeikiAnalytics.dll
Size 72KB
Sample240526-3d4yaagh25
SHA256 4390ca70996eb2d2cd95d97b503dc07535cc37701cdd352d8a7972ca2af5bc47
MD5 0bcd7d9656f89fb4fd7e365b6d8d2df0
SHA1 ccf28d74521258ba5500470d26f477cd5202aa73
SHA512 ad4c07b153972d9c7c2f41079fe4f572bcc11bab4cb0cac2dc25973a1f4b80842f08f8ea65f1bc7f71db01f5b928fb1d430eaf2b8b5497314b8f8c957123c50a
SSDEEP 1536:zZZZZZZZZZZZZpXzzzzzzzzzzzzkfGI4BbFCN4QL11Q5yzMqqU+2bbbAV2/S2OYm:GUs4QL1cIMqqDL2/OPvdj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	1736	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1736	2028	rundll32.exe	81
PID 2028 wrote to memory of 1736	2028	rundll32.exe	81
PID 2028 wrote to memory of 1736	2028	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bcd7d9656f89fb4fd7e365b6d8d2df0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bcd7d9656f89fb4fd7e365b6d8d2df0_NeikiAnalytics.dll,#1
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 624
    3⤵
    - Program crash
    PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1736 -ip 1736
1⤵
PID:1228