abac1316132c487c1c656b180f000ac36a4a283300b7cfc1f61329c1cdf64902

Analysis

max time kernel
51s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:52

Target
4aaaf472ca9947f0cc23b66460c37b00_NeikiAnalytics.dll
Size 1.2MB
Sample240612-2tdwcstfla
SHA256 abac1316132c487c1c656b180f000ac36a4a283300b7cfc1f61329c1cdf64902
MD5 4aaaf472ca9947f0cc23b66460c37b00
SHA1 eaad467430992dbbcaf19fc61d20222a4284ad1e
SHA512 4051436c9cdc11d4b656fa5152512ba2e2dc0d5c07d4035f121fde9d0d07b622c7f16fcf788f9955f1a98b5e69f9600647f5f343a43e30adc12a6d9c02c0d412
SSDEEP 24576:d/WUFE+1ShlWbY63z6zAUpxQaXKT1Gnl7yQFj3e/:hWUy+1SvWTM9xQOKT1Gnl7yQFj3e/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 3544	3740	rundll32.exe	82
PID 3740 wrote to memory of 3544	3740	rundll32.exe	82
PID 3740 wrote to memory of 3544	3740	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aaaf472ca9947f0cc23b66460c37b00_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aaaf472ca9947f0cc23b66460c37b00_NeikiAnalytics.dll,#1
  2⤵
  PID:3544