d93c8777c9d07dd0235b79bd9068366408d487169bc25ecbd80c60eda7e0adca

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 05:25

Target

a42ab21b4287e743f32d8c3dc6a96b20_NeikiAnalytics.dll
Size

5KB
MD5

a42ab21b4287e743f32d8c3dc6a96b20
SHA1

d4c9c1d02ae303327799051a49e17ac5d175efaa
SHA256

d93c8777c9d07dd0235b79bd9068366408d487169bc25ecbd80c60eda7e0adca
SHA512

c04a97dfc6ba04cc25564023f4ea4e2d117feaee4e9bed1ba056f3bf226ff15edd343b23d3bf55e3b16ef6cd88078da6134d74b12a95c699ff7c02e6bad11312
SSDEEP

96:hy859x0P8MaYYvycJKn17kdrJI3xNJpXpQlW:F5oL4rK1wJJIhxXX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 2640	4000	rundll32.exe	91
PID 4000 wrote to memory of 2640	4000	rundll32.exe	91
PID 4000 wrote to memory of 2640	4000	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a42ab21b4287e743f32d8c3dc6a96b20_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a42ab21b4287e743f32d8c3dc6a96b20_NeikiAnalytics.dll,#1
  2⤵
  PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1008