4442fe2be6f500735c28e3193fe2e0b5dbbb3b70eedbbbd289ed89db40f57869

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:11

Target
96078b78f7adca1b395b53e1b52a75f0_NeikiAnalytics.dll
Size 154KB
Sample240614-bj6khsygrf
SHA256 4442fe2be6f500735c28e3193fe2e0b5dbbb3b70eedbbbd289ed89db40f57869
MD5 96078b78f7adca1b395b53e1b52a75f0
SHA1 0ac1702e074319faa6dbdb0d0e37c4bde1b54ca1
SHA512 f91514f1629d6de8cfc14d65ae0daa7055ce5fbcfe5d37f204aff434c6de164767df5c910500a1a63f017231c36e9d82e5b9631631f3511e695d009f3530eafe
SSDEEP 3072:FWytrU+GIRzSZpxvsxj2Qtdi0OQ7giWhc/IXAoyBFM2Vq6Y2fkv8/zGV:FDtHOZnQtRIX56Y2ceze
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4680	3108	rundll32.exe	81
PID 3108 wrote to memory of 4680	3108	rundll32.exe	81
PID 3108 wrote to memory of 4680	3108	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96078b78f7adca1b395b53e1b52a75f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96078b78f7adca1b395b53e1b52a75f0_NeikiAnalytics.dll,#1
  2⤵
  PID:4680