0895b48bc825309a7e840bdf914ef0db5bdfa80384bb84d5ca6bd6f3a4f4c58e

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 13:23

Target

14979dd093c822125f9692c3bd876850_NeikiAnalytics.dll
Size

81KB
MD5

14979dd093c822125f9692c3bd876850
SHA1

975687ad390a6417a285963c3876aa33cddbbb9f
SHA256

0895b48bc825309a7e840bdf914ef0db5bdfa80384bb84d5ca6bd6f3a4f4c58e
SHA512

b43a18d27df6426550b30de93da893339edd225f30831aabab291e979041f0c33dfc75c25d75e1527b6f3795edbebef9dd6bacbb60f530253da7167c83142383
SSDEEP

1536:UtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WV:U4v4JKXTx71w0ArSsXF3enq8WV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 4764	2212	rundll32.exe	91
PID 2212 wrote to memory of 4764	2212	rundll32.exe	91
PID 2212 wrote to memory of 4764	2212	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14979dd093c822125f9692c3bd876850_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14979dd093c822125f9692c3bd876850_NeikiAnalytics.dll,#1
  2⤵
  PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4748