b05085d9376f6d499564a0d875b8f3df269a2f6e30131b6218e309907b36efc0

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:57

Target
6032e8d6b0e588b05e78f2c8a29efdb0_NeikiAnalytics.dll
Size 7KB
Sample240613-flcgnsydpl
SHA256 b05085d9376f6d499564a0d875b8f3df269a2f6e30131b6218e309907b36efc0
MD5 6032e8d6b0e588b05e78f2c8a29efdb0
SHA1 411a2d6b9d1d8162e094f0895fc12c0d3d66e622
SHA512 e97f6773715cf22a40a5ee5e449b190eac55bb5a96522d79447c31eb4d99293b02b9944faddcb1c1f4f72e6ec86ff8adbe3c3ccd191cbc95f566a2f34decb492
SSDEEP 96:DixZjmjtjd8jPjcZGR5TIB9vOjj6d/81rivEPg4Xh9Gj:unSR6bgYL4m1PhXy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 2324	3448	rundll32.exe	83
PID 3448 wrote to memory of 2324	3448	rundll32.exe	83
PID 3448 wrote to memory of 2324	3448	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6032e8d6b0e588b05e78f2c8a29efdb0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6032e8d6b0e588b05e78f2c8a29efdb0_NeikiAnalytics.dll,#1
  2⤵
  PID:2324