0955afdb4102b005ad1d9be502c11b62bf00183bfd95116425e2b0b14b8a82fb

Analysis

max time kernel
139s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:51

Target

0955afdb4102b005ad1d9be502c11b62bf00183bfd95116425e2b0b14b8a82fb_NeikiAnalytics.dll
Size

81KB
MD5

fa96860a4d6ac995bdc7743194111580
SHA1

df68414da81b4a33fa9463f55f4ee2b41ffaf6be
SHA256

0955afdb4102b005ad1d9be502c11b62bf00183bfd95116425e2b0b14b8a82fb
SHA512

b3d033dba73341af3c74d9240b4388a6d4d06e74b79100b39e4686e859bc29adb28181a8cf9cb724735f8873b719d46d467fbc52c0ea96baebb11734d7dd98a0
SSDEEP

1536:xByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Ww:Mv4JKXTx71wnArSsXFpeXq8Ww

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 3140	1528	rundll32.exe	91
PID 1528 wrote to memory of 3140	1528	rundll32.exe	91
PID 1528 wrote to memory of 3140	1528	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0955afdb4102b005ad1d9be502c11b62bf00183bfd95116425e2b0b14b8a82fb_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0955afdb4102b005ad1d9be502c11b62bf00183bfd95116425e2b0b14b8a82fb_NeikiAnalytics.dll,#1
  2⤵
  PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4076,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:8
1⤵
PID:4192