ff063270b3370218f0d9e873ecbc908d026032d36ac81073e9aa5152976f66e5

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:38

Target
c196584271ab92fb886e0c898e6a5a40_NeikiAnalytics.dll
Size 1.2MB
Sample240603-s3e1cabb2y
SHA256 ff063270b3370218f0d9e873ecbc908d026032d36ac81073e9aa5152976f66e5
MD5 c196584271ab92fb886e0c898e6a5a40
SHA1 68dcc12739f14bf8ab794636d6705022784672dd
SHA512 ac641010b6952ebee4e40b4ac590745b2abcf60fb65336346f788546a9982139b12a0e1079642af3871c5329b9f26956288b47830f6a3e8d510efeebd1eded84
SSDEEP 24576:NxMXvwxgx4yJ+UJr+NQi9l+ndkn4vLceV+T00nHhju:Nxavwxgx1JKXwknAcc6Bju
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1492	1476	rundll32.exe	82
PID 1476 wrote to memory of 1492	1476	rundll32.exe	82
PID 1476 wrote to memory of 1492	1476	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c196584271ab92fb886e0c898e6a5a40_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c196584271ab92fb886e0c898e6a5a40_NeikiAnalytics.dll,#1
  2⤵
  PID:1492