81932b4d803ac470cf47070f58822f1f118aec2b8fc1d37724d4755aa4f41967

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 21:29

Target

0c6f153b495ea84097bcae3be7722b90_NeikiAnalytics.dll
Size

64KB
MD5

0c6f153b495ea84097bcae3be7722b90
SHA1

32d6c4fbd82e4261712b26399704b44010b2ac83
SHA256

81932b4d803ac470cf47070f58822f1f118aec2b8fc1d37724d4755aa4f41967
SHA512

9744bc867591803514258da8c2a57cc6d4117d6cabce697ead9475b43a28a5eb9cc056086cefeb7344561cc0cc55d094737313e93318965a0496dce425d44021
SSDEEP

1536:2qHbH82Zj0v+xycVFUd9LNmCXkg2L7Sc:2q7ccYvYXV2d9LNmFZfS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 3560	3936	rundll32.exe	82
PID 3936 wrote to memory of 3560	3936	rundll32.exe	82
PID 3936 wrote to memory of 3560	3936	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c6f153b495ea84097bcae3be7722b90_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c6f153b495ea84097bcae3be7722b90_NeikiAnalytics.dll,#1
  2⤵
  PID:3560