79fad2b4810e8e7f4a829fe2e17cfbaec983cc3fd147d710ab1185fd311586ca

Analysis

max time kernel
132s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 21:53

Target
813116d007238b419d3cf3aedad4e070_NeikiAnalytics.dll
Size 76KB
Sample240531-1rmvtaef71
SHA256 79fad2b4810e8e7f4a829fe2e17cfbaec983cc3fd147d710ab1185fd311586ca
MD5 813116d007238b419d3cf3aedad4e070
SHA1 d8c6316d9bdfc0146c9238c11689b6dab2fb1724
SHA512 0f0a6fa0e1e951024b889660fa287e143e2dfc691938953d287b8027e7c6406de1389566c274f8ce2b79599bebc671018fea7cd0393354b0c1fe0c42e75baa4a
SSDEEP 1536:BZZZZZZZZZZZZJOEDlwYSMQsGHxg0TS+XKOVBMqqU+2bbbAV2/S2TrKUP:zlZHQsozTS+PVBMqqDL2/TrK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
428	1812	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 1812	5080	rundll32.exe	83
PID 5080 wrote to memory of 1812	5080	rundll32.exe	83
PID 5080 wrote to memory of 1812	5080	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\813116d007238b419d3cf3aedad4e070_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\813116d007238b419d3cf3aedad4e070_NeikiAnalytics.dll,#1
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 624
    3⤵
    - Program crash
    PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1812 -ip 1812
1⤵
PID:3028