4518a576a7a0ee08f256cf6b8e036fa6c073f0ae6ad79be340803c471a55e554

Analysis

max time kernel
41s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 08:56

Target

4518a576a7a0ee08f256cf6b8e036fa6c073f0ae6ad79be340803c471a55e554_NeikiAnalytics.dll
Size

148KB
MD5

bfc88630cd0faa48fb9fe584d6b69a50
SHA1

8f13a98d5d10badf54cdba1962f0608b10fbfe06
SHA256

4518a576a7a0ee08f256cf6b8e036fa6c073f0ae6ad79be340803c471a55e554
SHA512

197565a9aeaa23ede4bb4cbaf6c12a4192e67095c63a268d324dd4b7034c166ef3e0fae86cfa88964c48ae5d4516de3627fe4f3ace8fd8ed8dcc14d2816fda0b
SSDEEP

3072:CONwdRbSoxBsdDHhVYCmoSwihpCAKIXXBJLzc7ePoX:SiDBpihpCqLv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 2356	792	rundll32.exe	81
PID 792 wrote to memory of 2356	792	rundll32.exe	81
PID 792 wrote to memory of 2356	792	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4518a576a7a0ee08f256cf6b8e036fa6c073f0ae6ad79be340803c471a55e554_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4518a576a7a0ee08f256cf6b8e036fa6c073f0ae6ad79be340803c471a55e554_NeikiAnalytics.dll,#1
  2⤵
  PID:2356

memory/2356-0-0x0000000074FE7000-0x000000007500A000-memory.dmp

Filesize
140KB

Download