97523602420d93798e835dd7147fc69029cb7a75fe1f9f51bc6a4afdd1d8d01c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 22:12

Target

73e9023f99210c6c7fa7f7e765f6eb70_NeikiAnalytics.dll
Size

111KB
MD5

73e9023f99210c6c7fa7f7e765f6eb70
SHA1

cd4a6537852ff490938c79345b7f10fd6720bbb5
SHA256

97523602420d93798e835dd7147fc69029cb7a75fe1f9f51bc6a4afdd1d8d01c
SHA512

58bb37668f51b3ef83152ee80530ce7e4a209929a42c8f50250eb6b133e3625a7d10fb8eef23a2408b35bbce09bb03498410c77ab85fed07c6cd804af8346a67
SSDEEP

3072:xnL7Ot6WLta8ptY9+GRkor1/z6Sbe+jmsPANP:RAtawtYBzr1WthyANP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2452	1440	rundll32.exe	84
PID 1440 wrote to memory of 2452	1440	rundll32.exe	84
PID 1440 wrote to memory of 2452	1440	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73e9023f99210c6c7fa7f7e765f6eb70_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\73e9023f99210c6c7fa7f7e765f6eb70_NeikiAnalytics.dll,#1
  2⤵
  PID:2452