5528bb04607b5cdd69b36c806bbf840b3c44a7255d24eeadd08eeaef6b5d8be1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 00:02

Target

5ba3669221d38c3844565089aaa9d790_NeikiAnalytics.dll
Size

6KB
MD5

5ba3669221d38c3844565089aaa9d790
SHA1

396aa6201ff30e5fb19f67256a5b8ebf26213fe9
SHA256

5528bb04607b5cdd69b36c806bbf840b3c44a7255d24eeadd08eeaef6b5d8be1
SHA512

6cfc78a80f5f056f67f0fa2311da34a1d6b6453373f2439de5767198c05aea73c101fa3830676c7bff335027a282d644b653f152cca35c5e6b7d81c23ce499f3
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqqgYwJKIHUoGJSwJO+L:hy859x0P8MaqxwJao+LO+L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 1356	4020	rundll32.exe	83
PID 4020 wrote to memory of 1356	4020	rundll32.exe	83
PID 4020 wrote to memory of 1356	4020	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ba3669221d38c3844565089aaa9d790_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ba3669221d38c3844565089aaa9d790_NeikiAnalytics.dll,#1
  2⤵
  PID:1356