14f8098af1d4945a1cbe3bf9b31bdfa4d38d64df11431e7ea20e99bedb08cdbd

Analysis

max time kernel
53s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 20:04

Target

14f8098af1d4945a1cbe3bf9b31bdfa4d38d64df11431e7ea20e99bedb08cdbd_NeikiAnalytics.dll
Size

7.3MB
MD5

326c44b72ac8e1c06ec6861224975810
SHA1

814acbd496bde116f0c958c3f5a59e5a744a2ed8
SHA256

14f8098af1d4945a1cbe3bf9b31bdfa4d38d64df11431e7ea20e99bedb08cdbd
SHA512

3acbb7eab0784282681bd3c9bbdcb1b170ef5c7268c03944dd57e269d0bb82854297beef1dd2f0de6031dacef44dc5caa6d1586970e3ca55109ff3a202c03ae2
SSDEEP

98304:pM+4LvLUKPljsT0ModfHa1kZPOQt3Jxa2g1lgw1bpweKQoXIAAyP/U:u+GvLUK20eiPNtza2gvg6bpwIsA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3564	932	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 932	3156	rundll32.exe	81
PID 3156 wrote to memory of 932	3156	rundll32.exe	81
PID 3156 wrote to memory of 932	3156	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14f8098af1d4945a1cbe3bf9b31bdfa4d38d64df11431e7ea20e99bedb08cdbd_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14f8098af1d4945a1cbe3bf9b31bdfa4d38d64df11431e7ea20e99bedb08cdbd_NeikiAnalytics.dll,#1
  2⤵
  PID:932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 672
    3⤵
    - Program crash
    PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 932 -ip 932
1⤵
PID:4572