05195396252671b5579a209050377cee5c49097f2c93bc9edc515b3028899304

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 20:28

Target

05195396252671b5579a209050377cee5c49097f2c93bc9edc515b3028899304_NeikiAnalytics.dll
Size

4.9MB
MD5

8eef72c44a33d59e6723822160bac6d0
SHA1

75aa69d3aa8d62c49ba28c98fbe5cf80c38aaa08
SHA256

05195396252671b5579a209050377cee5c49097f2c93bc9edc515b3028899304
SHA512

f66de7ecc43116a6c660feeade86bf690e3f0a0ffe237a0abefe3dfa84d54a246f3bc038eb88c06f09575ee015736928bcbacdd136e8fe56a6c8f9add6761c3b
SSDEEP

98304:mkA8mn/RooR96R081ZQFnnm/GeCLL7+VUntqfba2+pJygg0F04IqULHYeGDmXOO5:4SlwFm+epXba2+pJBga0FDGKDhGjeTrd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3932	1900	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 1900	3840	rundll32.exe	83
PID 3840 wrote to memory of 1900	3840	rundll32.exe	83
PID 3840 wrote to memory of 1900	3840	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05195396252671b5579a209050377cee5c49097f2c93bc9edc515b3028899304_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05195396252671b5579a209050377cee5c49097f2c93bc9edc515b3028899304_NeikiAnalytics.dll,#1
  2⤵
  PID:1900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 696
    3⤵
    - Program crash
    PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1900 -ip 1900
1⤵
PID:1668