f3ec173f09d2ef6f2ecc6ce60def39872a23ffe5a9641c2bc2bac373a46a366c

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 13:24

Target
7fd6a7bd2672eb193ca35a04ee9857b0_NeikiAnalytics.dll
Size 4.2MB
Sample240613-qnhftavcmp
SHA256 f3ec173f09d2ef6f2ecc6ce60def39872a23ffe5a9641c2bc2bac373a46a366c
MD5 7fd6a7bd2672eb193ca35a04ee9857b0
SHA1 f5a889ad58e4355d2bff0b739f8c46fa020352b8
SHA512 dc3a1fd23360404db01b9aa72a3b63fc01e008b5d28f1f154f71314da09048e51460fdd6b6b78799974d0b31e3543070c004eb935e4bfb1d0b9b32331eabdf4b
SSDEEP 384:NTQC85siQViF3MekSgz08s6XKLxDiXtgElF4BcbWGgIW6Jh/cAyMt1mImrCnYI99:BQCAsiuiF3kYDsBXjgWnyMtQ1K
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 320	2204	rundll32.exe	82
PID 2204 wrote to memory of 320	2204	rundll32.exe	82
PID 2204 wrote to memory of 320	2204	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7fd6a7bd2672eb193ca35a04ee9857b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7fd6a7bd2672eb193ca35a04ee9857b0_NeikiAnalytics.dll,#1
  2⤵
  PID:320