07a17a726a9aad0fb0fc4732821adba0d6ea506e9b3d8a5e139ee11def24b71b

Analysis

max time kernel
93s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 10:47

Target

07a17a726a9aad0fb0fc4732821adba0d6ea506e9b3d8a5e139ee11def24b71b_NeikiAnalytics.dll
Size

6KB
MD5

6edec05e3f7cc2fb6a3e1957592baa40
SHA1

2875d324855ef9236e080de24d67cc1fabc6f983
SHA256

07a17a726a9aad0fb0fc4732821adba0d6ea506e9b3d8a5e139ee11def24b71b
SHA512

38bcddf6a6a8226aed07371d4ea626cb1765a069b0513957220676096d6c565e93d9022a55c626124073a03ef93b69aec4dc8e7aabe746a2fda843e96500f4ea
SSDEEP

48:6++Z5YVOeJVkrm1pwbEX7PFUE7aaO08XB+BDq9J5S1XU:6eJVkrmgbCbFUaaaUB+FqX5S1k

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 4656	2940	rundll32.exe	81
PID 2940 wrote to memory of 4656	2940	rundll32.exe	81
PID 2940 wrote to memory of 4656	2940	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07a17a726a9aad0fb0fc4732821adba0d6ea506e9b3d8a5e139ee11def24b71b_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07a17a726a9aad0fb0fc4732821adba0d6ea506e9b3d8a5e139ee11def24b71b_NeikiAnalytics.dll,#1
  2⤵
  PID:4656