29a09fcfb53ce4fd8d3dc9ae0e89d7f36d7d545baac4fb3543f84b17c1c4225e

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 22:07

Target

29a09fcfb53ce4fd8d3dc9ae0e89d7f36d7d545baac4fb3543f84b17c1c4225e_NeikiAnalytics.dll
Size

6KB
MD5

ea2fff69f6017a7708032a59dad7ac00
SHA1

0efb86f0cc4a6b14781d8079387d2169bf34cb9e
SHA256

29a09fcfb53ce4fd8d3dc9ae0e89d7f36d7d545baac4fb3543f84b17c1c4225e
SHA512

8d09c17540d8b6bc3511ce2a30319f6807c915ac5b5229379a9210ed21f97c5bddb0e6af026c6e12286dd0dadb707d56dda3ef3a1f88d3d9bbd27ef9dbc37c4c
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU10oB+BDq9J5SV3DY:CSVVEPozmB7eB+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 668	3748	rundll32.exe	82
PID 3748 wrote to memory of 668	3748	rundll32.exe	82
PID 3748 wrote to memory of 668	3748	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29a09fcfb53ce4fd8d3dc9ae0e89d7f36d7d545baac4fb3543f84b17c1c4225e_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29a09fcfb53ce4fd8d3dc9ae0e89d7f36d7d545baac4fb3543f84b17c1c4225e_NeikiAnalytics.dll,#1
  2⤵
  PID:668