998a67952a2335f02271fddaf0504c57e733c196cae3627a2c4b00ac555a2d17

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 13:13

Target

998a67952a2335f02271fddaf0504c57e733c196cae3627a2c4b00ac555a2d17_NeikiAnalytics.dll
Size

6KB
MD5

98378aee6ed349c37c01c2852a3f9900
SHA1

d6af38d34ea9cb42884a59a2ebad564e384d6b09
SHA256

998a67952a2335f02271fddaf0504c57e733c196cae3627a2c4b00ac555a2d17
SHA512

f2087fa0ed92d9ac4d06ff1c100354dc842fdcd0ddebfa3771eb6db27b0e2688d26330215bb274a0a1d186c57fd275cef9a418ad2e425a537d312e1fe622cd4e
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIagO30anhrjZ+lJpecvt6jJXWNXJpj9Z/Cfs:unSR6bgYSO30anhrjZRcvt6Sj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4904	4388	rundll32.exe	81
PID 4388 wrote to memory of 4904	4388	rundll32.exe	81
PID 4388 wrote to memory of 4904	4388	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\998a67952a2335f02271fddaf0504c57e733c196cae3627a2c4b00ac555a2d17_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\998a67952a2335f02271fddaf0504c57e733c196cae3627a2c4b00ac555a2d17_NeikiAnalytics.dll,#1
  2⤵
  PID:4904