2550d607a8bac2369ae44d790e5173d896989f367f24d94e0a1da31277ab3fb5

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 10:27

Target

7be1555763d50f55e1efcb2516479990_NeikiAnalytics.dll
Size

7KB
MD5

7be1555763d50f55e1efcb2516479990
SHA1

6834eb110d8a038dd2e883ff9433a73317a5a448
SHA256

2550d607a8bac2369ae44d790e5173d896989f367f24d94e0a1da31277ab3fb5
SHA512

3a33727b81e62065001810b86314badeae08f1e2d559d446b55f92a3e31e22c7258d5811d2c72137130bbf15cb5210783260fdec42ef0d1eb683e50f32cd4a46
SSDEEP

96:VGEETrMLH5KLuAaHQ3RRA3SCCbgAUn6rfJlpOpOtP0ckiF7W:efMALgkRAiLtUn6rRlpM6/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 5088	1356	rundll32.exe	82
PID 1356 wrote to memory of 5088	1356	rundll32.exe	82
PID 1356 wrote to memory of 5088	1356	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7be1555763d50f55e1efcb2516479990_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7be1555763d50f55e1efcb2516479990_NeikiAnalytics.dll,#1
  2⤵
  PID:5088