e832d14e9a77d95fca9194483afc02b717cf86059be751c6a3dd62b4db7936e7

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:08

Target

63c566a642e74c44c20e5e6f82e1dc10_NeikiAnalytics.dll
Size

358KB
MD5

63c566a642e74c44c20e5e6f82e1dc10
SHA1

4307bb21ed2f1b9952678395853ffc515473b878
SHA256

e832d14e9a77d95fca9194483afc02b717cf86059be751c6a3dd62b4db7936e7
SHA512

ef7bb88f313107431075707d62d3c78bd1c5d4a2873a822bd42081fef00c8674b29da8c27eb8039fdd5f2385df063356025f951c136f7cf33dc845e8ba23825b
SSDEEP

6144:ppHaR76iii0O7qcCMD67WXeumqDn8v3ayU4urg7Rz:rHaP0O7lCMD8WXIUuaJI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 228	3780	rundll32.exe	83
PID 3780 wrote to memory of 228	3780	rundll32.exe	83
PID 3780 wrote to memory of 228	3780	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63c566a642e74c44c20e5e6f82e1dc10_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63c566a642e74c44c20e5e6f82e1dc10_NeikiAnalytics.dll,#1
  2⤵
  PID:228

memory/228-0-0x0000000001560000-0x000000000159A000-memory.dmp

Filesize
232KB

Download