373ed63598486d4e1d9f10364ad259f156e88294915c868c291aa59898ad82ad

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:33

Target

70c75dbaf95026e6cbf6d6b366b31710_NeikiAnalytics.dll
Size

6KB
MD5

70c75dbaf95026e6cbf6d6b366b31710
SHA1

6638da0891eeaccdb0bed350fe62501215bd10ab
SHA256

373ed63598486d4e1d9f10364ad259f156e88294915c868c291aa59898ad82ad
SHA512

d947062a672b6cf977b418c4f6a22cb177a9b949efe29a6932f085345159e02c8a34a228ffd47985730d1901c831d53486e27f6a8cb4eacbf6e1d33efd2b389c
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0bzB+BDq9J5S2:0QDV8FscMjsLFV3vB+FqX5S2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 4868	1236	rundll32.exe	81
PID 1236 wrote to memory of 4868	1236	rundll32.exe	81
PID 1236 wrote to memory of 4868	1236	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70c75dbaf95026e6cbf6d6b366b31710_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70c75dbaf95026e6cbf6d6b366b31710_NeikiAnalytics.dll,#1
  2⤵
  PID:4868