4d95b482bdb2173852f55d936080dd5d16f9e3f455201c6c630ad08c85c0c486

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:00

Target
956b8d85bc3bd7e239ef9ee2eae585b0_NeikiAnalytics.dll
Size 6KB
Sample240614-bcpy7asdpq
SHA256 4d95b482bdb2173852f55d936080dd5d16f9e3f455201c6c630ad08c85c0c486
MD5 956b8d85bc3bd7e239ef9ee2eae585b0
SHA1 75884d0f3febf8fba0ccba63be7838ab308469b0
SHA512 b574c68b32a6b9cbb5bb05dc8a29ccf040bf42d13134fdb470e06db57a2c0e993af637a4e0cefe5e15486b284efb1749426cfadc7d9363b05992364134e97cdf
SSDEEP 96:DixZjmjtjd8jPjcZGR5TIcmy/NgN+lvtZ+CF89BkmlI:unSR6bgYpmINd+CFKBkmlI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 3320	4108	rundll32.exe	81
PID 4108 wrote to memory of 3320	4108	rundll32.exe	81
PID 4108 wrote to memory of 3320	4108	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\956b8d85bc3bd7e239ef9ee2eae585b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\956b8d85bc3bd7e239ef9ee2eae585b0_NeikiAnalytics.dll,#1
  2⤵
  PID:3320