9017124249263a19d2e1bd7e9ddfa755f0cdcdc2222cd2a3afd6702aef303959

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 16:13

Target

2bfbc8bafa9d2b8a5108c6a58c0b28f0_NeikiAnalytics.dll
Size

128KB
MD5

2bfbc8bafa9d2b8a5108c6a58c0b28f0
SHA1

698f8a450921eb7e4e4516a0e590614882fca319
SHA256

9017124249263a19d2e1bd7e9ddfa755f0cdcdc2222cd2a3afd6702aef303959
SHA512

f88daa922c27ba6e4fa2fa134e006dcfda0ce2d959dc6902d607978ca90d5073f45efe4a5e9d1cdbbd11b0eee49fb92c6743c50b006c467ff01caed74624fcec
SSDEEP

3072:CMWSGmj6LQuvm2xTKnKSkE5tRoUVFr2Jb:Z4Qgm2xTOKSzVeb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4844	4188	rundll32.exe	90
PID 4188 wrote to memory of 4844	4188	rundll32.exe	90
PID 4188 wrote to memory of 4844	4188	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bfbc8bafa9d2b8a5108c6a58c0b28f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bfbc8bafa9d2b8a5108c6a58c0b28f0_NeikiAnalytics.dll,#1
  2⤵
  PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:2812

memory/4844-0-0x00000000005D0000-0x00000000005F8000-memory.dmp

Filesize
160KB

Download