0c1479e1142dd1c9c1b235750da9e31bfdb29806924687ec57599186ebbe1f15

Analysis

max time kernel
132s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 20:46

Target

0c1479e1142dd1c9c1b235750da9e31bfdb29806924687ec57599186ebbe1f15_NeikiAnalytics.dll
Size

7KB
MD5

7676382b7a20e762d47d80c75d071a30
SHA1

6f8ca71120552c4539469b901fdb350e246435aa
SHA256

0c1479e1142dd1c9c1b235750da9e31bfdb29806924687ec57599186ebbe1f15
SHA512

345d121d95b7578abb14ac1bf7eed996f862fd0dcd4653b3044697d2eec404e18a6916dd43c24c9a0adac7b2b43c2142451e1cd30e01c0d07c53d0ed8722b2a9
SSDEEP

96:DixZjmjtjd8jPjcZGR5TI6ob/f3ENgz7YrUMaQgw6aKZkDFTBS+vV+ZECk:unSR6bgYC0Ng3sa7w6aKKDlU+vwZECk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 1360	3248	rundll32.exe	85
PID 3248 wrote to memory of 1360	3248	rundll32.exe	85
PID 3248 wrote to memory of 1360	3248	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c1479e1142dd1c9c1b235750da9e31bfdb29806924687ec57599186ebbe1f15_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c1479e1142dd1c9c1b235750da9e31bfdb29806924687ec57599186ebbe1f15_NeikiAnalytics.dll,#1
  2⤵
  PID:1360