733078817e55e4e81edf1f3b517f85b6612e900c73cb6f2dc1b2b80ae10050c6

Analysis

max time kernel
126s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 23:02

Target

18ad97cbefa204662019ebbcfec362f0_NeikiAnalytics.dll
Size

317KB
MD5

18ad97cbefa204662019ebbcfec362f0
SHA1

8ab76d5624d7c81e497fcb3f18232f75616c12b0
SHA256

733078817e55e4e81edf1f3b517f85b6612e900c73cb6f2dc1b2b80ae10050c6
SHA512

912f2afb03ecec268dfd0601cfd993ec46a901860aec8a652e1d63ec56a52e45bf4c3c97cf83bb0c95bd6001eb459acb4454a1a83f5a9c5b2adf5c51aa53e45f
SSDEEP

6144:kaXm4n6kR+thqEKaAKrOl0XZrJmYdvCLzFAOAZe3:9XfRkt1AKr40XZcY9CLxA63

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
692	rundll32.exe
692	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4452	692	WerFault.exe	90

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
692	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 692	3860	rundll32.exe	90
PID 3860 wrote to memory of 692	3860	rundll32.exe	90
PID 3860 wrote to memory of 692	3860	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18ad97cbefa204662019ebbcfec362f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18ad97cbefa204662019ebbcfec362f0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 880
    3⤵
    - Program crash
    PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 692 -ip 692
1⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1392,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
1⤵
PID:2260

memory/692-0-0x000000002A270000-0x000000002A2C5000-memory.dmp

Filesize
340KB

Download
memory/692-1-0x000000002A270000-0x000000002A2C5000-memory.dmp

Filesize
340KB

Download