71f6cb1c3fe5adf9bd15b9da6db5277717d21a5f5c85a92bdebd153cf700605a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 05:49

Target

352af650b66b44c00349d978d00a5d70_NeikiAnalytics.dll
Size

1KB
MD5

352af650b66b44c00349d978d00a5d70
SHA1

b4121082083c7e2f70ebef1e751127c218c5b9e2
SHA256

71f6cb1c3fe5adf9bd15b9da6db5277717d21a5f5c85a92bdebd153cf700605a
SHA512

0dab590e1660673aef3e36b214bd1187253e84e5577e3807fcf0548c1b2b98237318b6c23c17a4ce9e6ef4e03914dccf98ec9cb450788e8ed7a51910030c702c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	3172	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 3172	1324	rundll32.exe	83
PID 1324 wrote to memory of 3172	1324	rundll32.exe	83
PID 1324 wrote to memory of 3172	1324	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\352af650b66b44c00349d978d00a5d70_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\352af650b66b44c00349d978d00a5d70_NeikiAnalytics.dll,#1
  2⤵
  PID:3172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 544
    3⤵
    - Program crash
    PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3172 -ip 3172
1⤵
PID:3184

memory/3172-0-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download