2df458a1c41b44fff01c11fc6f1158b66aa5b0f02a5eff6829b7db062ad1f840

Analysis

max time kernel
90s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 05:04

Target

28921e34643019bd270acb64c57cd6c0_NeikiAnalytics.dll
Size

22KB
MD5

28921e34643019bd270acb64c57cd6c0
SHA1

2e7efaf77b2b00e0268f5ac53cc826b95c892a7b
SHA256

2df458a1c41b44fff01c11fc6f1158b66aa5b0f02a5eff6829b7db062ad1f840
SHA512

b339dcf21c89102ff69278f6efc4a90a8490cfe12f791e0a0e085a0ca61e5dda06c335392a69b63b395daebc9b1a2dfdd918a1300eb32a3db36eee33dc30a29d
SSDEEP

384:+H/lOYQwgGpYiP7mNJk5WMbyM6j4dzMdrZ6TYnYPLQjyIANweMw1y:+9Y+7mNJ6WMbP84NeFC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	1400	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1400	2272	rundll32.exe	83
PID 2272 wrote to memory of 1400	2272	rundll32.exe	83
PID 2272 wrote to memory of 1400	2272	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28921e34643019bd270acb64c57cd6c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28921e34643019bd270acb64c57cd6c0_NeikiAnalytics.dll,#1
  2⤵
  PID:1400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 604
    3⤵
    - Program crash
    PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1400 -ip 1400
1⤵
PID:4648