4838f8bb6e36cdebc893ec95e38f5365e38f7a8d9e7ec9f6dde5ad148e0fac04

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 20:03

Target

00757e74ead55043588efbbfe86fbcd0_NeikiAnalytics.dll
Size

2.0MB
MD5

00757e74ead55043588efbbfe86fbcd0
SHA1

f7e676046c3e8a426f1a3f716ccc6a8971e24822
SHA256

4838f8bb6e36cdebc893ec95e38f5365e38f7a8d9e7ec9f6dde5ad148e0fac04
SHA512

7a3487414d8ba12f349e3b35341f67f0a4a56d0f220247086c72760afcd45b7a80c1364d4765c99e9a50f4551d0d32c2453f6d230f2d8ba66e977e7de289bbdb
SSDEEP

49152:SpX9JVeE9Hv/Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akh:a3P9HXZpy9KyhMI50Du8LljslNsyHiqZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3760	5032	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 5032	1892	rundll32.exe	81
PID 1892 wrote to memory of 5032	1892	rundll32.exe	81
PID 1892 wrote to memory of 5032	1892	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00757e74ead55043588efbbfe86fbcd0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00757e74ead55043588efbbfe86fbcd0_NeikiAnalytics.dll,#1
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 600
    3⤵
    - Program crash
    PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5032 -ip 5032
1⤵
PID:1636