fb84f6bac0de1d978048e57d74f914b1b7abd3ca27b4bfb6c3789ec3c2b6226e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:13

Target
4bf44b4e0ee51681baedc4283a1f3aa0_NeikiAnalytics.dll
Size 55KB
Sample240612-27d4aaybjp
SHA256 fb84f6bac0de1d978048e57d74f914b1b7abd3ca27b4bfb6c3789ec3c2b6226e
MD5 4bf44b4e0ee51681baedc4283a1f3aa0
SHA1 7fcdfc6745edec6864691422d7440e657e9d4e75
SHA512 120228954751dfb3922a4183f79352d11eb3d22fe9bb88d50bf37a7df8f4396c0bfd0c09ade041951c2389c89c95f198eb7094492e5b704045e815590a236e0f
SSDEEP 1536:hbLOdfwMD/czL75YPmS9IujClrYlMv/Ah1:hnOdfqzL7OPmS9IuQrKH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1692	4976	rundll32.exe	81
PID 4976 wrote to memory of 1692	4976	rundll32.exe	81
PID 4976 wrote to memory of 1692	4976	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf44b4e0ee51681baedc4283a1f3aa0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf44b4e0ee51681baedc4283a1f3aa0_NeikiAnalytics.dll,#1
  2⤵
  PID:1692