e80141b6ccaf157e19e2667913c3a62a24baf2188b23db4c49efc217a9779ba5

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:02

Target
6b3e35aed3b4d76168b299b98a4798a0_NeikiAnalytics.dll
Size 2.8MB
Sample240613-jw5srazfph
SHA256 e80141b6ccaf157e19e2667913c3a62a24baf2188b23db4c49efc217a9779ba5
MD5 6b3e35aed3b4d76168b299b98a4798a0
SHA1 62da34d2dd83d82831f37b5e5c53e99478d7b59d
SHA512 bce49cd47a3b394768d0229e4de3b7059fc897a29651e99ded17381de03c3337fbc5e6cf053f880c29b61759116543a037c63dadadb90a0a497facb16f32842c
SSDEEP 49152:AgFjixxRuxl8JKcjJwDM0n8EjvHItYRrCOvRc1Ecorq3eRem9Ph97PXcWZUcMsdZ:AUuxxRuxSUaeHnTjvH4YvQfelD7PrZU2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3352	2256	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2256	2644	rundll32.exe	82
PID 2644 wrote to memory of 2256	2644	rundll32.exe	82
PID 2644 wrote to memory of 2256	2644	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b3e35aed3b4d76168b299b98a4798a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b3e35aed3b4d76168b299b98a4798a0_NeikiAnalytics.dll,#1
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 608
    3⤵
    - Program crash
    PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2256 -ip 2256
1⤵
PID:116

memory/2256-0-0x0000000010000000-0x0000000010685000-memory.dmp

Download

memory/2256-1-0x0000000010000000-0x0000000010685000-memory.dmp

Download