49942979e35c960a7252c08c9353ae4d29635e07056b77337fff378945d3b2ee

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:45

Target
a24f2b468a2f6a1ccdaa79e33d452b20_NeikiAnalytics.dll
Size 327KB
Sample240603-nw632aef37
SHA256 49942979e35c960a7252c08c9353ae4d29635e07056b77337fff378945d3b2ee
MD5 a24f2b468a2f6a1ccdaa79e33d452b20
SHA1 56e62a13f900c63c6a669cb2cca0cb24b37ed969
SHA512 2c62ade5284cbfde2866591640b7095d47c8d277d6ce3cce7ca3ad76c28df4811576b750cab8af73637241ccd90e69d273dccf9b3a0cbe14fbbea9ac4f576ccc
SSDEEP 6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 1572	4252	rundll32.exe	81
PID 4252 wrote to memory of 1572	4252	rundll32.exe	81
PID 4252 wrote to memory of 1572	4252	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a24f2b468a2f6a1ccdaa79e33d452b20_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a24f2b468a2f6a1ccdaa79e33d452b20_NeikiAnalytics.dll,#1
  2⤵
  PID:1572