584c8ffaf0d733af4fa7cfa94656a4e2e559a95fd6ce410cda73a28c19271094

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 11:10

Target

584c8ffaf0d733af4fa7cfa94656a4e2e559a95fd6ce410cda73a28c19271094_NeikiAnalytics.dll
Size

6KB
MD5

cbda53c22bbb948735e8bbd932a95b10
SHA1

990b41321e8a8ecbc8822749e9dbcbd4c25402be
SHA256

584c8ffaf0d733af4fa7cfa94656a4e2e559a95fd6ce410cda73a28c19271094
SHA512

95dc17972edf89e52fbb696d44b7d1934fc5087a7862d3efb7dbf5f9775dee1bc32a4ee0c9edd135b19ceb12be12b7ad00e48b9a8ce70f201e640d4be2ddc462
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0bB+BDq9J5SH:VDa9VUX9bQW7B+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1424	4532	rundll32.exe	81
PID 4532 wrote to memory of 1424	4532	rundll32.exe	81
PID 4532 wrote to memory of 1424	4532	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\584c8ffaf0d733af4fa7cfa94656a4e2e559a95fd6ce410cda73a28c19271094_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\584c8ffaf0d733af4fa7cfa94656a4e2e559a95fd6ce410cda73a28c19271094_NeikiAnalytics.dll,#1
  2⤵
  PID:1424