75c07f287903ccb26bb7bce73182f971f5399b65fb3fd96e403fd141aa7b6f4b

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:59

Target
a2a6095eba19b9c0308635f9d0d637b0_NeikiAnalytics.dll
Size 327KB
Sample240603-n5s8jadf81
SHA256 75c07f287903ccb26bb7bce73182f971f5399b65fb3fd96e403fd141aa7b6f4b
MD5 a2a6095eba19b9c0308635f9d0d637b0
SHA1 7c71ecd6a28880184d9fc2e79f10cccfc0124f8c
SHA512 38c5aabc54d1d345eeef056af76a432dabdef3f43632737814be9705701bdc402fd517b54230aace53427dcf169ccbb5d5db74fa90d96694315a02c055764b75
SSDEEP 6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2184	5108	rundll32.exe	83
PID 5108 wrote to memory of 2184	5108	rundll32.exe	83
PID 5108 wrote to memory of 2184	5108	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2a6095eba19b9c0308635f9d0d637b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2a6095eba19b9c0308635f9d0d637b0_NeikiAnalytics.dll,#1
  2⤵
  PID:2184