28709122efe35f9e9d07c8fe56686147fea9a707ed211c3017a3e14bce8c1c71

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 01:12

Target

28709122efe35f9e9d07c8fe56686147fea9a707ed211c3017a3e14bce8c1c71_NeikiAnalytics.dll
Size

274KB
MD5

68802fe397c2098e2adc863b30c43d00
SHA1

489900a7788a0d59db77657be62babf241c5cf3a
SHA256

28709122efe35f9e9d07c8fe56686147fea9a707ed211c3017a3e14bce8c1c71
SHA512

9947a5a5cf9dcf0a2158164d0f79d72947f1c63db44ebb1e516111908959fffc95e66ae4c25825c4d7f8f4a4955e783392faa7f7dd71acb05d56a5613150cc37
SSDEEP

6144:sl73UrE42px4TYEyDXTZELp1WPzTBNazKpzTBNUW:KrUrE42pVDtELpG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 392	1352	rundll32.exe	81
PID 1352 wrote to memory of 392	1352	rundll32.exe	81
PID 1352 wrote to memory of 392	1352	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28709122efe35f9e9d07c8fe56686147fea9a707ed211c3017a3e14bce8c1c71_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28709122efe35f9e9d07c8fe56686147fea9a707ed211c3017a3e14bce8c1c71_NeikiAnalytics.dll,#1
  2⤵
  PID:392