b7023894445338f732c0227ed710bd585e6f38dedd4ff8c6c9490d814ed4ed81

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 06:41

Target
49c14aa02a6869839d8255dd51df9350_NeikiAnalytics.dll
Size 81KB
Sample240602-hfwpgaee62
SHA256 b7023894445338f732c0227ed710bd585e6f38dedd4ff8c6c9490d814ed4ed81
MD5 49c14aa02a6869839d8255dd51df9350
SHA1 8da3b6ca1420752e937c96ca6fe904e5791d91aa
SHA512 d0c68552a17c88a8c0c758023bfb93d7dd9758ea197da0f37becb376e404dcf8592f08433e118aa0a78646aba716047e0783d303b4fa4ae889fa9c6dcf845ae2
SSDEEP 1536:aByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Wp:7v4JKXTx71wnArSsXFpeXq8Wp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 8	3336	rundll32.exe	82
PID 3336 wrote to memory of 8	3336	rundll32.exe	82
PID 3336 wrote to memory of 8	3336	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49c14aa02a6869839d8255dd51df9350_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49c14aa02a6869839d8255dd51df9350_NeikiAnalytics.dll,#1
  2⤵
  PID:8