ab032db8e141a732a198937c9f0a74f3d967b1caa1035e1c22ce895238ab4a41

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 12:15

Target

ab032db8e141a732a198937c9f0a74f3d967b1caa1035e1c22ce895238ab4a41_NeikiAnalytics.dll
Size

304KB
MD5

e0723a282f3caed0bf59f94d106a6b10
SHA1

3789b6dc8da7ab88d2bfb50a9d93b7d840456943
SHA256

ab032db8e141a732a198937c9f0a74f3d967b1caa1035e1c22ce895238ab4a41
SHA512

f8ce2641dffab607b5fb527ba08e22be3e2bec061a639ad3dbeecc7e24a8044088864db470c08732410843416b549f3b0d6d747f44c805c7d7758e470ad3fce1
SSDEEP

96:cBcNkn8wyL3ulySdT4nO/W8vpUjDRYjDR0+8NJ5ErRHHX:l+2q/BjWa6jVYjVpMJ5El3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	3544	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 3544	3684	rundll32.exe	81
PID 3684 wrote to memory of 3544	3684	rundll32.exe	81
PID 3684 wrote to memory of 3544	3684	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab032db8e141a732a198937c9f0a74f3d967b1caa1035e1c22ce895238ab4a41_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab032db8e141a732a198937c9f0a74f3d967b1caa1035e1c22ce895238ab4a41_NeikiAnalytics.dll,#1
  2⤵
  PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 644
    3⤵
    - Program crash
    PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3544 -ip 3544
1⤵
PID:3496