c8b01aa1a996900ec93a7a3e03df8e7cdc67eedb68d7984d9c882ae9962a8400

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:43

Target

545a982750d200e572df360de312c1f0_NeikiAnalytics.dll
Size

192KB
MD5

545a982750d200e572df360de312c1f0
SHA1

69bad70076277575af70d5a0835a62c09bb244ff
SHA256

c8b01aa1a996900ec93a7a3e03df8e7cdc67eedb68d7984d9c882ae9962a8400
SHA512

6e7e59848e996882d2da84f92511350a70fb1d60402523954511daa92eb5b0363e742872915ca6b234d9c3db6966292640bbf9b9971d3c8df0f00222ba35d728
SSDEEP

3072:zYhhvWGlXvjIgdULxkAHw/ejMpgNeozfoj8FRvJlih/gDWgDKL:zYhTRekH/ejMGNewoh/gDWgDKL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	468	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 468	3756	rundll32.exe	81
PID 3756 wrote to memory of 468	3756	rundll32.exe	81
PID 3756 wrote to memory of 468	3756	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\545a982750d200e572df360de312c1f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\545a982750d200e572df360de312c1f0_NeikiAnalytics.dll,#1
  2⤵
  PID:468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 600
    3⤵
    - Program crash
    PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 468 -ip 468
1⤵
PID:4028