9abe59756d43b936e623640b38cdc95519c7b7194669a5b6e6e6fa74c8cf0224

Analysis

max time kernel
131s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 01:06

Target

2ab428a043429f10921b272f14487280_NeikiAnalytics.dll
Size

81KB
MD5

2ab428a043429f10921b272f14487280
SHA1

0faa095d34d3b75f8ef86b0d8eb3d1b7ae91b6b8
SHA256

9abe59756d43b936e623640b38cdc95519c7b7194669a5b6e6e6fa74c8cf0224
SHA512

5784d42f024ed387ec20dc0bfa39610ee1e2c02a740af24e0fbeb4b58f4665e9274855d2c19bc2049b2ed1af2317e5f5eadf129ab5536366a258796c0e7052ef
SSDEEP

1536:KtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WX:K4v4JKXTx71w0ArSsXF3enq8WX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4824	4736	rundll32.exe	83
PID 4736 wrote to memory of 4824	4736	rundll32.exe	83
PID 4736 wrote to memory of 4824	4736	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ab428a043429f10921b272f14487280_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ab428a043429f10921b272f14487280_NeikiAnalytics.dll,#1
  2⤵
  PID:4824