2ca28b836a61950a9bb64337a9c3e06edf854b987cc5cc1b52e24ff4653e2de3

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 12:37

Target

ec9f706d0013a90b379e138cf6d03620_NeikiAnalytics.dll
Size

4.7MB
MD5

ec9f706d0013a90b379e138cf6d03620
SHA1

6c65b11650043a760e1a6cf3215a84e7fb3d2c2a
SHA256

2ca28b836a61950a9bb64337a9c3e06edf854b987cc5cc1b52e24ff4653e2de3
SHA512

435d42829716aabc89d0439a1034fac3a5bd07c9de7e8d9e1535826819b67263f6b057d67ee46378c3f4ad511808856e105633ecd4917e191ed1634980b14339
SSDEEP

98304:sNtg7mohjef029NgDoqykTIaxO9coeADQA8qZvzLLt3itIFew6VA:szIh6fN0fTIZ//tytS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4488	2960	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2960	1896	rundll32.exe	90
PID 1896 wrote to memory of 2960	1896	rundll32.exe	90
PID 1896 wrote to memory of 2960	1896	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec9f706d0013a90b379e138cf6d03620_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec9f706d0013a90b379e138cf6d03620_NeikiAnalytics.dll,#1
  2⤵
  PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 652
    3⤵
    - Program crash
    PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2960 -ip 2960
1⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
1⤵
PID:1000