21ed4688b8cc979243160b91a9ac1a6a583b58ab22cd8019ff0c50bc7d89a299

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:04

Target
dac24fe8adc3e42acbdf07f5351d93e0_NeikiAnalytics.dll
Size 947KB
Sample240603-th5wpsch98
SHA256 21ed4688b8cc979243160b91a9ac1a6a583b58ab22cd8019ff0c50bc7d89a299
MD5 dac24fe8adc3e42acbdf07f5351d93e0
SHA1 9dbbe638e33d1419c88f6bf49e09ae5182d911ba
SHA512 6da0901ea906e4675f2b8c17e087b9d98baaaf9bd6bb0c55c8f75fabedac585068708e36564a6e9926eca35bebb4abe4af6c1c666dc21e76583f16a1036e0d0c
SSDEEP 24576:UNthcGVL6hBd1HEqP8KRRgWy/Magicb80Bwu6av:sB6rzHELQRgD0agicb80Bwu6av
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1436	rundll32.exe
1436	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 1436	3432	rundll32.exe	83
PID 3432 wrote to memory of 1436	3432	rundll32.exe	83
PID 3432 wrote to memory of 1436	3432	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dac24fe8adc3e42acbdf07f5351d93e0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dac24fe8adc3e42acbdf07f5351d93e0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1436