19a80d8334f348d95f5a91d58ea9f40d1266b1cd3e79e55a9ba67aea180c3321

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:34

Target

a519f473267e26a8386e61177198bf90_NeikiAnalytics.dll
Size

160KB
MD5

a519f473267e26a8386e61177198bf90
SHA1

eeed1e2f8a6cbd962b6399657d0cfddd2926967f
SHA256

19a80d8334f348d95f5a91d58ea9f40d1266b1cd3e79e55a9ba67aea180c3321
SHA512

79fcd0a4fc560700b25edbd3a7852513e939c4a367164719242f9dd5d5cadc806ada3701856468a2399d48911e0bdd3aa3e49b4ba3ce04adaf59fdbbea7c713f
SSDEEP

3072:BbOJ0EL7wzI+MoiCx1a1crhdOzEeEaNtSVfxW:Bb9Lzci1a1cFdOzWUSVfxW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 228	1412	rundll32.exe	82
PID 1412 wrote to memory of 228	1412	rundll32.exe	82
PID 1412 wrote to memory of 228	1412	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a519f473267e26a8386e61177198bf90_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a519f473267e26a8386e61177198bf90_NeikiAnalytics.dll,#1
  2⤵
  PID:228