dd2bc3f8366cd4f89e70cd3b93d0b98911bb3b702d653278b170c4627b0355cc

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:06

Target
6f5d335ced6bf906f48130351eaea370_NeikiAnalytics.dll
Size 446KB
Sample240613-k23e9asclf
SHA256 dd2bc3f8366cd4f89e70cd3b93d0b98911bb3b702d653278b170c4627b0355cc
MD5 6f5d335ced6bf906f48130351eaea370
SHA1 1113df0e466da8525c18cafa0a7384b7c306eb4f
SHA512 c62117946158795d96486876f8b2e7a7d4b00c8fd426574429848b5fe30beb343884514b67352019c61f7e6756a48e38c782e933acbf42ca86f0b334551568e4
SSDEEP 3072:TBE6o8qalYozMP+cR9X5QE6Q7sP6VdrFlQ3ArcQHAQs/MllG+GU:VPHlYo4DRReE6Q7sSdrTQ3ArjHg/+vGU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 1652	372	regsvr32.exe	81
PID 372 wrote to memory of 1652	372	regsvr32.exe	81
PID 372 wrote to memory of 1652	372	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6f5d335ced6bf906f48130351eaea370_NeikiAnalytics.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6f5d335ced6bf906f48130351eaea370_NeikiAnalytics.dll
  2⤵
  PID:1652