25dd22eb57bba1946a9566317e8d13122de5ebc0bbefdf768e1a8b2989c92ff9

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 00:10

Target

25dd22eb57bba1946a9566317e8d13122de5ebc0bbefdf768e1a8b2989c92ff9_NeikiAnalytics.dll
Size

966KB
MD5

aecc89395d5f92435cd7eaf06c06b080
SHA1

72a18ec4ed3f1785bd103de089fe2b03927f66a0
SHA256

25dd22eb57bba1946a9566317e8d13122de5ebc0bbefdf768e1a8b2989c92ff9
SHA512

8e07725dfad63285191f7fbca4c6335813baf2e2f9f12fcfe69f22efdd7d337737e387f47f79db48d7d937bc8b704aa5fcdcda585f04fefccd271b7b4a366e7e
SSDEEP

24576:If0TfklyKuJGavkg3Ny4WbbbVKHYsa4QhBAUZLYr5vxSg:caayKuJGaXFQK4sDQhBAUZLYrtxp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
544	3656	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3656	3040	rundll32.exe	80
PID 3040 wrote to memory of 3656	3040	rundll32.exe	80
PID 3040 wrote to memory of 3656	3040	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25dd22eb57bba1946a9566317e8d13122de5ebc0bbefdf768e1a8b2989c92ff9_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25dd22eb57bba1946a9566317e8d13122de5ebc0bbefdf768e1a8b2989c92ff9_NeikiAnalytics.dll,#1
  2⤵
  PID:3656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 600
    3⤵
    - Program crash
    PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3656 -ip 3656
1⤵
PID:2552

memory/3656-0-0x0000000068080000-0x0000000068174000-memory.dmp

Filesize
976KB

Download