b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 19:57

Target

b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3_NeikiAnalytics.dll
Size

6KB
MD5

c1313e24f7e1823691401f96bbe27be0
SHA1

387fe77faf513a4b033db2c77a5532d3571e5ad6
SHA256

b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3
SHA512

35e99090d76660439a0b4d21740a72b33468d7285a6e9c6c4290ffa1e582c0314c99452ddf2885f62279c34eff7091b8bec947c99bbc139a412928092406d036
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0VnB+BDq9J5SC:8qtV0HAr4IB+FqX5SC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 5068	2472	rundll32.exe	80
PID 2472 wrote to memory of 5068	2472	rundll32.exe	80
PID 2472 wrote to memory of 5068	2472	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9b9daa9dbac1dff157105cc1554e0adcd9d6585ee0f42275653eb1f339fb8f3_NeikiAnalytics.dll,#1
  2⤵
  PID:5068