8562c4d7b1bdd0a7df2d019cea037ac3091c80f2286b9a5f4f9f0b6162ff502d

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 15:06

Target

8562c4d7b1bdd0a7df2d019cea037ac3091c80f2286b9a5f4f9f0b6162ff502d_NeikiAnalytics.dll
Size

6KB
MD5

5830a961eb87ee1062a25cc806e88d80
SHA1

c7d16bfaccd98109aa8509def00287115b1b090e
SHA256

8562c4d7b1bdd0a7df2d019cea037ac3091c80f2286b9a5f4f9f0b6162ff502d
SHA512

b7febcf87dbf9430adc233afc47c86e89e52d81e7939378ca5571f5fbc7e096b8910214ac8e2fe94479ee137b3d78fbf720861aac43018cebaaec51112b4b92f
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIxz1xaUazn3tysaW3YWDD+CM4N+AV:unSR6bgYQraUAn3LakYWPe47

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 804	1440	rundll32.exe	82
PID 1440 wrote to memory of 804	1440	rundll32.exe	82
PID 1440 wrote to memory of 804	1440	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8562c4d7b1bdd0a7df2d019cea037ac3091c80f2286b9a5f4f9f0b6162ff502d_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8562c4d7b1bdd0a7df2d019cea037ac3091c80f2286b9a5f4f9f0b6162ff502d_NeikiAnalytics.dll,#1
  2⤵
  PID:804