e180262fa23508eb588a22bb9faf2dd2a3cf275cb12f2d402a2d9b9ce23c5455

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:31

Target
6d07ebb10f0c376fe83728c5e4903910_NeikiAnalytics.dll
Size 844KB
Sample240613-ket6cs1dmg
SHA256 e180262fa23508eb588a22bb9faf2dd2a3cf275cb12f2d402a2d9b9ce23c5455
MD5 6d07ebb10f0c376fe83728c5e4903910
SHA1 db30bc8fa70e00cb7d8063bc438d37f4621a6b07
SHA512 013fdbc5619b69c597e5b2bfd5267be010d3268b325f260bd213ab2c0b9461b7bed9ec03aac05b336997489076e02b4da5a769d07fb1d598a70727e0b1362fed
SSDEEP 12288:C9MlqH7DewJpg/AaeSsVnsSATexWXsl6ydTI87ybvP9ZNIET+jEM7czXUCMlr:CBOIZnC062EZvP9IET+4M7cz2
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NDISAPI.log	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\NDISAPI.log	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2668	3040	rundll32.exe	81
PID 3040 wrote to memory of 2668	3040	rundll32.exe	81
PID 3040 wrote to memory of 2668	3040	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d07ebb10f0c376fe83728c5e4903910_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d07ebb10f0c376fe83728c5e4903910_NeikiAnalytics.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2668

NDISAPI.log

Path C:\Windows\SysWOW64\NDISAPI.log
Size 729B
SHA256 27f9cbbb9d481bd5a8d41a88682dcc26f14e6945ddd773ad75e9a3491c8b26c3
MD5 2b7a55a64720ba65080a73ab689868b8
SHA1 cd036df27a1f69c017c38349a14c9e51661ecef4
SHA512 b0bc1ab3c2b0e87a7fe66c26009be3c655375df7b1cd66cb9a9e8593c81bb9b1ac0b0a368a4f88fc39dac5def3e98557fff61035f4d0d65215d6943c6f3a7738
MD5 SHA1 SHA512

Submit Download