25c69ca66d2831f0957742e2ca3a759e2d8aa736e21df012620ab8aa8b42c48c

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 23:37

Target

25c69ca66d2831f0957742e2ca3a759e2d8aa736e21df012620ab8aa8b42c48c_NeikiAnalytics.dll
Size

208KB
MD5

cb3e8140e4d72625637830fb0a205ab0
SHA1

43342102f5de6f9f4c2ec8d0c5b3e88e8e4f8d6a
SHA256

25c69ca66d2831f0957742e2ca3a759e2d8aa736e21df012620ab8aa8b42c48c
SHA512

8e859890eaa40857df031000628717b3fd4f73c2bfc7d5e93f172cf5a5439793c391412e105de4f43c386c19b75b3e96b6909814d0e14bc6cd7510158f92816e
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUfY5gF:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3612 1920 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3612	1920	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4480 wrote to memory of 1920	4480	rundll32.exe	rundll32.exe
PID 4480 wrote to memory of 1920	4480	rundll32.exe	rundll32.exe
PID 4480 wrote to memory of 1920	4480	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c69ca66d2831f0957742e2ca3a759e2d8aa736e21df012620ab8aa8b42c48c_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c69ca66d2831f0957742e2ca3a759e2d8aa736e21df012620ab8aa8b42c48c_NeikiAnalytics.dll,#1
2⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 632
3⤵
- Program crash
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1920 -ip 1920
1⤵
PID:2796