08ebf929dad20f64c84bf713a8821897faaaf58a6d6e5e7f5a2de491eb368b23

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 20:22

Target

08ebf929dad20f64c84bf713a8821897faaaf58a6d6e5e7f5a2de491eb368b23_NeikiAnalytics.dll
Size

4.4MB
MD5

3fcd0394c2d7cd902a025ba3c44ccb80
SHA1

ace8b19e7d8fa102cd540423cd0ede7271b08ad7
SHA256

08ebf929dad20f64c84bf713a8821897faaaf58a6d6e5e7f5a2de491eb368b23
SHA512

1695cc1ea380a47d90067775ce50a7a3aa93b0c0a9ecacbb8394abdb7437f36bdc0d6c1a204b74d3f1f7b419605852e41148c47995b701a2177546705a95982e
SSDEEP

49152:+Ko8EP4vJkrIVK4sIU3HAeLvM5U0QxnoCfTkaPKHUjoRL5C2RElmCs2260aQ:+9P4vJkrIVKDIU3HAeLE53WnuvUMfCu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4008	4196	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4196	5116	rundll32.exe	81
PID 5116 wrote to memory of 4196	5116	rundll32.exe	81
PID 5116 wrote to memory of 4196	5116	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08ebf929dad20f64c84bf713a8821897faaaf58a6d6e5e7f5a2de491eb368b23_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08ebf929dad20f64c84bf713a8821897faaaf58a6d6e5e7f5a2de491eb368b23_NeikiAnalytics.dll,#1
  2⤵
  PID:4196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 656
    3⤵
    - Program crash
    PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4196 -ip 4196
1⤵
PID:4276