a1c803fcf1517028cd90efac93bebaad7a01e1ebd78421039ff0a8472ca32b8b

Analysis

max time kernel
136s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 19:32

Target

d97b6171811733c489e0e70adac454f0_NeikiAnalytics.dll
Size

3.8MB
MD5

d97b6171811733c489e0e70adac454f0
SHA1

c8812d2ac7292b601b30d1d98a2cbf6a38531093
SHA256

a1c803fcf1517028cd90efac93bebaad7a01e1ebd78421039ff0a8472ca32b8b
SHA512

b2fa0f54476fd09981bcd569d28ed598fe0bb8fd5c8cc6881d0cb997004cd214e634946b737ff1b79636559938f5502ae69a486beb2799ed22ceacd88d3a769f
SSDEEP

49152:CueTqzEBHKBLu7Y5AYKTxo3jcgHWArXN/ZOD9hSgBt+y+ijdNmkgyo:CZQEBHKRu7Y5AYK1o3jcaMD9uyNvs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3420	4884	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4884	4764	rundll32.exe	91
PID 4764 wrote to memory of 4884	4764	rundll32.exe	91
PID 4764 wrote to memory of 4884	4764	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d97b6171811733c489e0e70adac454f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d97b6171811733c489e0e70adac454f0_NeikiAnalytics.dll,#1
  2⤵
  PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 644
    3⤵
    - Program crash
    PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4884 -ip 4884
1⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5164 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:3500