bb789b62ece1060c105c64d70f18f3d03a9e6b757403b2c8b643eb1c511b776b

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2024 19:27

Target

313a9a3bb6b1e03248ef2050dbcefc70_NeikiAnalytics.dll
Size

44KB
MD5

313a9a3bb6b1e03248ef2050dbcefc70
SHA1

a83beeec326637413d5d8024ca2668eaf32c5bd5
SHA256

bb789b62ece1060c105c64d70f18f3d03a9e6b757403b2c8b643eb1c511b776b
SHA512

7f190087ab1bfd28ae22c21ddfa963584384a4e4f5cc06c6813cca29b4a70db98064fc7a01cd90863ce3b1d8586bc32f0845313145822938d466b77e92b652c3
SSDEEP

384:fYJVovJ4MvbDGnJSdm7njyaNHLgyHhopymLZqDZeRM5UynD:fYJVm48DOckjyaNrgyHh6Fc8RM5HnD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 4872	3024	rundll32.exe	82
PID 3024 wrote to memory of 4872	3024	rundll32.exe	82
PID 3024 wrote to memory of 4872	3024	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\313a9a3bb6b1e03248ef2050dbcefc70_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\313a9a3bb6b1e03248ef2050dbcefc70_NeikiAnalytics.dll,#1
  2⤵
  PID:4872