13763712369768a51ab91e4425d94a8d395c6f532b1fe135b3c89650eb4bf4e7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 14:30

Target
f950d29b4f8513a56871a67621d55110_NeikiAnalytics.dll
Size 48KB
Sample240608-rvb32scd9w
SHA256 13763712369768a51ab91e4425d94a8d395c6f532b1fe135b3c89650eb4bf4e7
MD5 f950d29b4f8513a56871a67621d55110
SHA1 a06fb844b7996b5fb150a2df9e2227b2897e126b
SHA512 0c3932f4115bb11afd265520a27339642c1fa58d14cc466222e2b8f2afedc297c575d2471797d6ac3f6cde875eecf8047d87692811fc92119d0477af57ffdb77
SSDEEP 768:HNA3giFTqVvJg0Ma4RqjwnbLOM9muoAMW:HjiFTqfgqknbx7o
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
640	1984	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 1984	3812	rundll32.exe	81
PID 3812 wrote to memory of 1984	3812	rundll32.exe	81
PID 3812 wrote to memory of 1984	3812	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f950d29b4f8513a56871a67621d55110_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f950d29b4f8513a56871a67621d55110_NeikiAnalytics.dll,#1
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 600
    3⤵
    - Program crash
    PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1984 -ip 1984
1⤵
PID:2832