4ce9213b1049ebffc54c9950ff3f527696975f9fc30edabbb5884ffffcfd3b30

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 22:24

Target

460f62357efc8edc11cee106a49c5570_NeikiAnalytics.dll
Size

6KB
MD5

460f62357efc8edc11cee106a49c5570
SHA1

e8337f14633cc87e467159310019d15508d06558
SHA256

4ce9213b1049ebffc54c9950ff3f527696975f9fc30edabbb5884ffffcfd3b30
SHA512

a72c7504641e137c0e2fca18db03b4321e73f601216e62fec9848faeff464a041b4eacba94008dd182a2ec63e4a6444f4f53e8943bf5792306e3eef020c3bd5d
SSDEEP

96:nI2RrUeqeMb4BnATYvyYbolj38jMtXYJt4WKl3cDk:XR4e/bKYvgr8SXyklAk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4908	3868	rundll32.exe	89
PID 3868 wrote to memory of 4908	3868	rundll32.exe	89
PID 3868 wrote to memory of 4908	3868	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\460f62357efc8edc11cee106a49c5570_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\460f62357efc8edc11cee106a49c5570_NeikiAnalytics.dll,#1
  2⤵
  PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:732