43422d02b97d377494468f0aec3f8fce5a7d7a37cf5026e7c37a4c5809f478b9

Analysis

max time kernel
133s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 08:28

Target

43422d02b97d377494468f0aec3f8fce5a7d7a37cf5026e7c37a4c5809f478b9_NeikiAnalytics.dll
Size

164KB
MD5

8fb88a6b31e3f47460d01f96bd8456d0
SHA1

5183b7530155d1a14d00b286e90634c096f7c711
SHA256

43422d02b97d377494468f0aec3f8fce5a7d7a37cf5026e7c37a4c5809f478b9
SHA512

b4c73087f893af7f74413c39ef7e0fb88f40fa25dd50e023bd1b2e346b8ba908233c5cee0b04fcfe4bff9526d2d70e945755033829f4566f6a770731c4cbd98a
SSDEEP

3072:bUOxxl4MRbSIPjmktEYCmoTvihpQ2iYvI0XBJ8ycqRJ:bUYxqemihpQ2FL8GJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3536	1720	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 1720	2952	rundll32.exe	82
PID 2952 wrote to memory of 1720	2952	rundll32.exe	82
PID 2952 wrote to memory of 1720	2952	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43422d02b97d377494468f0aec3f8fce5a7d7a37cf5026e7c37a4c5809f478b9_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43422d02b97d377494468f0aec3f8fce5a7d7a37cf5026e7c37a4c5809f478b9_NeikiAnalytics.dll,#1
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 600
    3⤵
    - Program crash
    PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1720 -ip 1720
1⤵
PID:1424