5c8bb31d911cf0311e8923d84d5395bb0cc431ba13d72acd05fa1ebc8377249b

Analysis

max time kernel
91s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 01:40

Target

5c8bb31d911cf0311e8923d84d5395bb0cc431ba13d72acd05fa1ebc8377249b_NeikiAnalytics.dll
Size

6KB
MD5

9ae519a4c3a65655a513ca43cc088440
SHA1

cb9aae5a6954abddc79425d8f6da02e2b04b5bbf
SHA256

5c8bb31d911cf0311e8923d84d5395bb0cc431ba13d72acd05fa1ebc8377249b
SHA512

cdb551d7bd0a16ffeb00fe96b954e06ab7568aa63285f869241a0b3e6575460004fe6bc225357246a8d02e11502d13af4cf8371402db1bd90754674989f6e655
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU10zB+BDq9J5SV3DY:CSVVEPozmB7RB+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 1168	528	rundll32.exe	81
PID 528 wrote to memory of 1168	528	rundll32.exe	81
PID 528 wrote to memory of 1168	528	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c8bb31d911cf0311e8923d84d5395bb0cc431ba13d72acd05fa1ebc8377249b_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c8bb31d911cf0311e8923d84d5395bb0cc431ba13d72acd05fa1ebc8377249b_NeikiAnalytics.dll,#1
  2⤵
  PID:1168