29ffd540bfbf2d4eeb839c6d1ca7dd15e624db2efa1c9635bb74af74d70aeae1

Analysis

max time kernel
41s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 01:11

Target

29ffd540bfbf2d4eeb839c6d1ca7dd15e624db2efa1c9635bb74af74d70aeae1_NeikiAnalytics.dll
Size

1.1MB
MD5

3bc69871ec6e48cfcf81950f6776d580
SHA1

df6ca4f98f8b06b92fc5a60759f197b15540dd8d
SHA256

29ffd540bfbf2d4eeb839c6d1ca7dd15e624db2efa1c9635bb74af74d70aeae1
SHA512

003a05cc4c3f660a87add549d90fc42aa018bfdc1dfdf74ecc64bcd765765f2343e1724311fd19442ad428004e12e37cfbf5d4710293b38e3e7e9fb6873e5230
SSDEEP

24576:S41F9JaehDZDdBOmiln5WAVqp2dJDm/ueqEdUnbEa6A9BDCw/i8yRX4TSYRdkd4+:SeJaehDZDdBOmiln5WAVqp2dJDm/ueqa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3400	1104	rundll32.exe	80
PID 1104 wrote to memory of 3400	1104	rundll32.exe	80
PID 1104 wrote to memory of 3400	1104	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29ffd540bfbf2d4eeb839c6d1ca7dd15e624db2efa1c9635bb74af74d70aeae1_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29ffd540bfbf2d4eeb839c6d1ca7dd15e624db2efa1c9635bb74af74d70aeae1_NeikiAnalytics.dll,#1
  2⤵
  PID:3400