09bb677554b408ff1ed83ec80258cc5a2e1b5ffbf130b8f775239871288b2feb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 17:44

Target

09bb677554b408ff1ed83ec80258cc5a2e1b5ffbf130b8f775239871288b2feb_NeikiAnalytics.dll
Size

6KB
MD5

a37a019b19802df75b765555dc34e090
SHA1

2f761a1973c90b13d38e2bc0d2f2c67bcd7ae705
SHA256

09bb677554b408ff1ed83ec80258cc5a2e1b5ffbf130b8f775239871288b2feb
SHA512

cc4df0ed56cc8f66f6a815c5be7bdc962160b177faa89465e01690202b4bed9819b2a08b9503c0e1d0ef188df16fa4816ecbb86d904a78c0f4748d43424f6d3e
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqZdxmJW2Wv+Lj6Bii+rqvSAHAmXyPV0WWzs:hy859x0P8Ma4UgfNrAg2y1i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 3420	2588	rundll32.exe	80
PID 2588 wrote to memory of 3420	2588	rundll32.exe	80
PID 2588 wrote to memory of 3420	2588	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09bb677554b408ff1ed83ec80258cc5a2e1b5ffbf130b8f775239871288b2feb_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09bb677554b408ff1ed83ec80258cc5a2e1b5ffbf130b8f775239871288b2feb_NeikiAnalytics.dll,#1
  2⤵
  PID:3420