d68a3bdcfd39fe9880bb5392e8ead0ea825893c5f6ecb4e3864ee3e215022ed8

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:02

Target
957bad24b5515869248fa7094bfb8a50_NeikiAnalytics.dll
Size 5KB
Sample240614-bdtc1ayemc
SHA256 d68a3bdcfd39fe9880bb5392e8ead0ea825893c5f6ecb4e3864ee3e215022ed8
MD5 957bad24b5515869248fa7094bfb8a50
SHA1 a6992071b3aea69d5cbe9cf1d67aea0d82fb1990
SHA512 49545fd9056b4c303d808740f2f29e4418da486c467cfb63ce2bff6f19dc991d54aeca039c1e5cd2fa373e084f4254a28042d7f29aabef28313ca13d9bd39c2b
SSDEEP 48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqyeOfQ40wx7RLstwUOxDI4+/c/CUr2o2aUb:hy859x0P8MayegdhVLstCU4CoyEw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1732	2476	rundll32.exe	82
PID 2476 wrote to memory of 1732	2476	rundll32.exe	82
PID 2476 wrote to memory of 1732	2476	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\957bad24b5515869248fa7094bfb8a50_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\957bad24b5515869248fa7094bfb8a50_NeikiAnalytics.dll,#1
  2⤵
  PID:1732