95f3bfe7f0bd76ddf4a262ca97316ee051e339557a1c7910987b24dedbefdba8

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:51

Target

51153da6f9f38b24dce3cfb4d2289890_NeikiAnalytics.dll
Size

81KB
MD5

51153da6f9f38b24dce3cfb4d2289890
SHA1

cfa31451843d6511d5afe9c4499a615b565dd5f5
SHA256

95f3bfe7f0bd76ddf4a262ca97316ee051e339557a1c7910987b24dedbefdba8
SHA512

177e36e14ea33e8751de5b882c7d320c1bb82a5b0ac0f06619ae0b685ee33c6cf7bd391ac8d7afd573784280c88157def50defae48befcf302214393eeb6f134
SSDEEP

1536:htByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8W4:h4v4JKXTx71w0ArSsXF3enq8W4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4268 wrote to memory of 1236	4268	rundll32.exe	rundll32.exe
PID 4268 wrote to memory of 1236	4268	rundll32.exe	rundll32.exe
PID 4268 wrote to memory of 1236	4268	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51153da6f9f38b24dce3cfb4d2289890_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51153da6f9f38b24dce3cfb4d2289890_NeikiAnalytics.dll,#1
2⤵
PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:3416