06facf143e21dc98e9e3ba432684ead4f5bc20968cc123a4239a018a520a12a2

Analysis

max time kernel
91s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 06:56

Target

49830af5a961f2501eb5e6e463ff2a20_NeikiAnalytics.dll
Size

5KB
MD5

49830af5a961f2501eb5e6e463ff2a20
SHA1

b5c48c5656a33eea49e71c80aae4488c9eaf6a92
SHA256

06facf143e21dc98e9e3ba432684ead4f5bc20968cc123a4239a018a520a12a2
SHA512

e01ac85292c92f44bb73f3dc02f697244309e655d6c490f7956bd71072cdf61fa6931112ffa7ce1f0fea57abccc95aa86a4a056a017731270d1fee11a1af2faa
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqHW1f75YLufFK6RhInuaGYBG0/QAULk1/e4:hy859x0P8MaHyauM6UuaO1L8BLxW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2720	808	rundll32.exe	82
PID 808 wrote to memory of 2720	808	rundll32.exe	82
PID 808 wrote to memory of 2720	808	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49830af5a961f2501eb5e6e463ff2a20_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49830af5a961f2501eb5e6e463ff2a20_NeikiAnalytics.dll,#1
  2⤵
  PID:2720