b6190ca521fe7b6a21db5e89c76078eb617ef3500a6fb01b89f13f4a6d983a2e

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 22:09

Target

11a82432f2366f3a950765e033a50980_NeikiAnalytics.dll
Size

1.7MB
MD5

11a82432f2366f3a950765e033a50980
SHA1

86e6f27418ee56c4e8aed6e81b66d247745a2387
SHA256

b6190ca521fe7b6a21db5e89c76078eb617ef3500a6fb01b89f13f4a6d983a2e
SHA512

69e5e30bc9224581f711cf8b9e91fa3418a35ad3dcb1cba2059d517819e7221b9eafa0e63ec84e4d0147ca0ebd330ed6742237708365fa4acc9c636ba6d43298
SSDEEP

24576:buvA3wGPvVdpqPQfkTVPQh7uy6sWmQ1KyoC6nNobrEYQb+bbQXzHdXaL+:zwIVdKVPQh7sKnobriXzVa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4548	1732	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 1732	3640	rundll32.exe	82
PID 3640 wrote to memory of 1732	3640	rundll32.exe	82
PID 3640 wrote to memory of 1732	3640	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11a82432f2366f3a950765e033a50980_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11a82432f2366f3a950765e033a50980_NeikiAnalytics.dll,#1
  2⤵
  PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 652
    3⤵
    - Program crash
    PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1732 -ip 1732
1⤵
PID:2548

memory/1732-0-0x0000000002260000-0x0000000002589000-memory.dmp

Filesize
3.2MB

Download
memory/1732-1-0x0000000002260000-0x0000000002589000-memory.dmp

Filesize
3.2MB

Download