bd8694b7a638e9f45fce931699f806ddbfd9e3ab356027f509cdd611be62f978

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:13

Target

5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll
Size

94KB
MD5

5e177b1a18e0831839f8bbc08c1de620
SHA1

8352fea352e99c31040f071d2cd45d382c89a3bf
SHA256

bd8694b7a638e9f45fce931699f806ddbfd9e3ab356027f509cdd611be62f978
SHA512

1b4730c95e27671086555850f919e1d4264c5a1d70af9a4a2a2ccd2ee03d56f3439d6edc5ac256e7e42f1975fcae4d6316f0d5dae100127d32b8ba054b077ced
SSDEEP

1536:nx52vQBKLmh4jIUs7ghzerjJC8kVidxfUjQRKr2nTWExTOojRO:nxIvQBK+7rghzSLkIdxfmQ0oTOoj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3140	3448	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 3448	4344	rundll32.exe	83
PID 4344 wrote to memory of 3448	4344	rundll32.exe	83
PID 4344 wrote to memory of 3448	4344	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.dll,#1
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 600
    3⤵
    - Program crash
    PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3448 -ip 3448
1⤵
PID:212